8c9b5f65769690470df4c997ebd1f472_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8c9b5f65769690470df4c997ebd1f472_JaffaCakes118
Size

103KB
MD5

8c9b5f65769690470df4c997ebd1f472
SHA1

b2c6a2d814f82616bfef7e2f70ee3fa405f2e3ba
SHA256

62bd3ad67b647b5f1fd949f70256027b365a4116e094733d20b1f36694f638a2
SHA512

e1efa5db99371e6d5a5c00004cd376935fb880111d76355ce3224672205cf6fcb164caa6bb48b35c4f5fa457f5811155daccffccd79a25dfd9451e42981a2ad8
SSDEEP

1536:/LgiDvN77ACpPAgv3GFmUA/kbPemIziIz53LgZxoCFWTyeg46t+A:fzFUCRAB2/ktUJKvoJTE+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8c9b5f65769690470df4c997ebd1f472_JaffaCakes118

Files

8c9b5f65769690470df4c997ebd1f472_JaffaCakes118
.exe windows:6 windows x86 arch:x86

33f6e338e409ba3e1cd76beb120826fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

msvcrt

exit

ntdll

EtwEventWrite

api-ms-win-core-heap-l1-2-0

HeapFree

oleaut32

SysReAllocString

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-1

GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-1

CoCancelCall

api-ms-win-core-processthreads-l1-1-2

CreateThread

api-ms-win-core-libraryloader-l1-2-0

LoadStringW

api-ms-win-core-registry-l1-1-0

RegCloseKey

api-ms-win-security-base-l1-2-0

AddAce

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-debug-l1-1-1

DebugBreak

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetTickCount

api-ms-win-core-file-l1-2-1

ReadFile

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-processenvironment-l1-2-0

SearchPathW

rpcrt4

RpcBindingFree

api-ms-win-security-lsalookup-l2-1-1

LookupAccountNameW

api-ms-win-security-credentials-l1-1-0

CredFree

bcrypt

BCryptHashData

api-ms-win-core-kernel32-legacy-l1-1-1

GetComputerNameW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathIsPrefixW

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-registry-l2-1-0

RegOpenKeyTransactedW

api-ms-win-security-lsapolicy-l1-1-0

LsaClose

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

ubpm

UbpmApiBufferFree

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook

ktmw32

CreateTransaction

Sections

.MPRESS1
Size: 95KB - Virtual size: 360KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

33f6e338e409ba3e1cd76beb120826fd

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

ntdll

api-ms-win-core-heap-l1-2-0

oleaut32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

rpcrt4

api-ms-win-security-lsalookup-l2-1-1

api-ms-win-security-credentials-l1-1-0

bcrypt

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-security-lsapolicy-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

ubpm

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-delayload-l1-1-1

ktmw32

Sections

.MPRESS1 Size: 95KB - Virtual size: 360KB

.MPRESS2 Size: 5KB - Virtual size: 5KB

.rsrc Size: 2KB - Virtual size: 1KB

.MPRESS1
Size: 95KB - Virtual size: 360KB

.MPRESS2
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 2KB - Virtual size: 1KB