90d371a2c3bbe3c5e8492a7e2fa01fb1_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

90d371a2c3bbe3c5e8492a7e2fa01fb1_JaffaCakes118
Size

563KB
MD5

90d371a2c3bbe3c5e8492a7e2fa01fb1
SHA1

85603186129401a8cfafcd768518bdbb61f89354
SHA256

3348fb9463f0cb8c933a909cf19e9247c8b141d485da56ea2cf26e49c0470b2d
SHA512

b06953c81e177a227134b8827642dc53ed5ec4de20a2ef09d37c8ad84a16ec64756a20d61c2a099e2d7281721bf352ee8c87c38fd0421f32163b4f0d3ab5a297
SSDEEP

6144:EyYTwhAXjUq01wEd0Rso/rkyOqkskyYYA3A7SM17+oLtNSzpHpv2dYMD00cA3Dpx:EyoFXja507rOqhcYEAP7DpWYqn0Fp0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
90d371a2c3bbe3c5e8492a7e2fa01fb1_JaffaCakes118

Files

90d371a2c3bbe3c5e8492a7e2fa01fb1_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b4dc9705f36f7f5e5fcfe243429b6e76

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
SHGetFileInfoA
DragAcceptFiles
DragQueryFileA
DragFinish
ShellExecuteA

advapi32

RegQueryValueExA
RegCreateKeyA
RegSetValueA
GetUserNameA
RegCloseKey
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegDeleteKeyA

kernel32

HeapSize
CloseHandle
CreateFileA
GetEnvironmentStrings
GlobalAlloc
GetProcAddress
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
Sleep
ExitProcess
WriteFile
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
RtlUnwind
LoadLibraryA
HeapAlloc
VirtualAlloc
HeapReAlloc
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
FlushFileBuffers
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 439KB - Virtual size: 439KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b4dc9705f36f7f5e5fcfe243429b6e76

Headers

DLL Characteristics

File Characteristics

Imports

shell32

advapi32

kernel32

Sections

.text Size: 60KB - Virtual size: 59KB

.rdata Size: 439KB - Virtual size: 439KB

.data Size: 4KB - Virtual size: 178KB

.rsrc Size: 59KB - Virtual size: 58KB

.text
Size: 60KB - Virtual size: 59KB

.rdata
Size: 439KB - Virtual size: 439KB

.data
Size: 4KB - Virtual size: 178KB

.rsrc
Size: 59KB - Virtual size: 58KB