5ee3c3abb2c9fd0fd6db5ae2b7423700_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

5ee3c3abb2c9fd0fd6db5ae2b7423700_JaffaCakes118
Size

1.1MB
MD5

5ee3c3abb2c9fd0fd6db5ae2b7423700
SHA1

ba741a2563f3108a8f711b5bb38a4e3a4c4a7baa
SHA256

ede2504ec02e47f60ce40ba5d5270ef744c1fd55587fbe0948700909fc4de210
SHA512

a942562631ce7fabef993859188cb2d6e69186c1e315b4becd4217999057c2abe78ce52d38a6548b9a0eda8a902bead0745a592c04731acd7db05823e63bb298
SSDEEP

24576:55WHosVWTTv9LPBewfBCXzVTNXXXXXXHWgSm637V7F++ttHLg6HOF:+Hos8nlbpfBCXzVTNXXXXXXxSVntSV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ee3c3abb2c9fd0fd6db5ae2b7423700_JaffaCakes118

Files

5ee3c3abb2c9fd0fd6db5ae2b7423700_JaffaCakes118
.exe windows:6 windows x64 arch:x64

f6d53d0958316e2542054654369dc88d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Ton\Documents\Visual Studio 2013\Projects\Xenos\build\x64\Release\Xenos64.pdb

Imports

shlwapi

SHSetValueW

dbghelp

MiniDumpWriteDump

kernel32

CloseHandle
GetWindowsDirectoryW
ExitProcess
SetUnhandledExceptionFilter
GetCurrentProcess
WaitForSingleObject
Sleep
GetModuleFileNameW
CreateFileW
FlushFileBuffers
GetLocalTime
GetCurrentThreadId
GetCurrentProcessId
CreateThread
GetFileAttributesW
ResumeThread
GetNativeSystemInfo
FindResourceW
LoadResource
GetModuleHandleW
WriteFile
DeleteCriticalSection
GetProcAddress
LockResource
DeleteFileW
TerminateProcess
VirtualProtect
DecodePointer
GetLastError
RaiseException
InitializeCriticalSectionEx
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
CreateProcessW
SetEnvironmentVariableA
SetEndOfFile
WriteConsoleW
SetStdHandle
ReadConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetVersionExW
UnregisterWaitEx
InitializeSListHead
ReleaseSemaphore
GetModuleHandleA
FreeLibraryAndExitThread
OutputDebugStringW
GetOEMCP
GetACP
GetTimeZoneInformation
SizeofResource
GetThreadTimes
HeapSize
GetConsoleMode
WideCharToMultiByte
FormatMessageW
MultiByteToWideChar
LocalFree
LeaveCriticalSection
EnterCriticalSection
DeviceIoControl
FreeLibrary
LoadLibraryW
GetTickCount
QueueUserAPC
ResetEvent
GetCurrentThread
VirtualFree
GetExitCodeProcess
VirtualAlloc
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetTempFileNameW
MapViewOfFile
UnmapViewOfFile
CreateActCtxW
GetTempPathW
ReleaseActCtx
CreateFileMappingW
InitializeCriticalSection
Thread32First
Thread32Next
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetThreadContext
SetThreadContext
CreateRemoteThread
VirtualQueryEx
VirtualFreeEx
ReadProcessMemory
VirtualProtectEx
VirtualAllocEx
IsWow64Process
WriteProcessMemory
CreateNamedPipeW
TerminateThread
ReadFile
OpenThread
GetExitCodeThread
GetConsoleCP
SuspendThread
OpenProcess
GetEnvironmentVariableW
ActivateActCtx
GetSystemDirectoryW
DeactivateActCtx
GetCurrentDirectoryW
Module32FirstW
GetSystemInfo
GetStringTypeW
DuplicateHandle
EncodePointer
HeapFree
RtlPcToFileHeader
HeapAlloc
CreateTimerQueue
IsProcessorFeaturePresent
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
SetEvent
WaitForSingleObjectEx
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCPInfo
GetCommandLineW
HeapReAlloc
IsDebuggerPresent
RtlLookupFunctionEntry
RtlUnwindEx
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
GetStartupInfoW
CreateSemaphoreW
ExitThread
LoadLibraryExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
GetProcessHeap
GetModuleHandleExW
AreFileApisANSI
SetFilePointerEx
IsValidCodePage

user32

GetMenu
LoadIconW
EnableMenuItem
CreateWindowExW
DestroyIcon
wsprintfW
DestroyWindow
TranslateAcceleratorW
GetMessageW
DialogBoxParamW
SendMessageA
TranslateMessage
LoadAcceleratorsW
IsDialogMessageW
GetWindowTextW
GetDlgItem
EndDialog
ShowWindow
CreateDialogParamW
IsWindow
MessageBoxW
SendMessageW
EnableWindow
SetWindowTextW
DispatchMessageW

comdlg32

GetOpenFileNameW
GetSaveFileNameW

shell32

DragQueryFileW

advapi32

RegCloseKey
LookupPrivilegeValueW
RegEnumValueW
RegCreateKeyW
RegOpenKeyW
AdjustTokenPrivileges
RegSetValueExW
OpenProcessToken
OpenThreadToken

ole32

CoUninitialize
CoInitialize
CoCreateInstance

Sections

.text
Size: 598KB - Virtual size: 597KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 200KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 309KB - Virtual size: 309KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f6d53d0958316e2542054654369dc88d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

dbghelp

kernel32

user32

comdlg32

shell32

advapi32

ole32

Sections

.text Size: 598KB - Virtual size: 597KB

.rdata Size: 200KB - Virtual size: 199KB

.data Size: 17KB - Virtual size: 46KB

.pdata Size: 30KB - Virtual size: 29KB

.rsrc Size: 309KB - Virtual size: 309KB

.text
Size: 598KB - Virtual size: 597KB

.rdata
Size: 200KB - Virtual size: 199KB

.data
Size: 17KB - Virtual size: 46KB

.pdata
Size: 30KB - Virtual size: 29KB

.rsrc
Size: 309KB - Virtual size: 309KB