81e2d45079092e7ae2baf800311ce9a5_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

81e2d45079092e7ae2baf800311ce9a5_JaffaCakes118
Size

608KB
MD5

81e2d45079092e7ae2baf800311ce9a5
SHA1

08f506f6a90bd70ff54e88aaed334e409b1f7374
SHA256

dbc39fad8d389e1d0b35687f1457d7ed1ac0e70046e03ebc74d4da82eab07595
SHA512

bde9141be051b6081e9b3e4bc6335d5fc61dd8aa454a04f89a78522b70bd482deeaf330ed16a3a99124d55a2f212aac5dc3a7c71b1eb2a3f0891ca00188afe64
SSDEEP

6144:tLeWXUcZosPmPZcUF1qa3TO2HTuBsZMZ+0s6GaBop8CSIhrUZaBaKBRVzdQ4IxgO:hjZuXRydEVUUB1S8xlujhR6Zvy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
81e2d45079092e7ae2baf800311ce9a5_JaffaCakes118

Files

81e2d45079092e7ae2baf800311ce9a5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

93956db1a3688b21689acc677f6cf0e5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

debug.pdb

Imports

kernel32

GetShortPathNameA
ResetEvent
GetAtomNameW
InterlockedExchange
CreateEventW
FindFirstFileA
FormatMessageW
GetLogicalDrives
GetComputerNameW
GetTickCount
GetFullPathNameA
SetStdHandle
InterlockedDecrement
GetProcAddress
CloseHandle
CompareStringW
GetEnvironmentVariableW
CreateNamedPipeW
GetDiskFreeSpaceA
CreateSemaphoreA
GetModuleHandleA
FileTimeToSystemTime
CreateMutexA
GetLocalTime
FindResourceA
GetLocaleInfoA
DeviceIoControl
DeleteFileA
OpenFileMappingA
GetStringTypeA

shlwapi

UrlHashA
UrlIsOpaqueW
UrlGetLocationA
PathCompactPathA
UrlIsA
UrlGetPartA
UrlIsNoHistoryA
PathCombineA
UrlEscapeA
UrlCombineA
UrlCanonicalizeA

authz

AuthzFreeResourceManager
AuthzAddSidsToContext

user32

IsCharLowerW
IsZoomed
LoadCursorA
GetCaretPos
IsDialogMessageA
GetWindowLongA
CreateWindowExA
PostMessageW
GetMessageW
GetWindowTextA
IsWindow
SetFocus

cfgmgr32

CMP_Report_LogOn
CMP_UnregisterNotification
CM_Add_Range

wtsapi32

WTSVirtualChannelClose
WTSEnumerateServersA
WTSVirtualChannelPurgeInput
WTSQuerySessionInformationA
WTSVirtualChannelWrite
WTSCloseServer
WTSEnumerateProcessesA
WTSOpenServerA
WTSSendMessageA
WTSWaitSystemEvent
WTSVirtualChannelRead
WTSEnumerateSessionsA

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 546KB - Virtual size: 600KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

93956db1a3688b21689acc677f6cf0e5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shlwapi

authz

user32

cfgmgr32

wtsapi32

Sections

.text Size: 49KB - Virtual size: 49KB

.data Size: 3KB - Virtual size: 7KB

.rsrc Size: 546KB - Virtual size: 600KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 49KB - Virtual size: 49KB

.data
Size: 3KB - Virtual size: 7KB

.rsrc
Size: 546KB - Virtual size: 600KB

.reloc
Size: 8KB - Virtual size: 7KB