9204381f4e4f4e2b28e6bff5f1c3b656_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

9204381f4e4f4e2b28e6bff5f1c3b656_JaffaCakes118
Size

72KB
MD5

9204381f4e4f4e2b28e6bff5f1c3b656
SHA1

17e7628fa011aa2bf12c04e87db0f805c17f8b91
SHA256

2abecf4ce93c5a8d5f8903155ab92aa1d91d1615a36b5d6ecd66b51b5ebb7cba
SHA512

0a34373503a815440bf7b9c4918fe27f5007348a65a614f994a778371ffc61bbc4dbfc6f081dc3385cc29d5ed303a54c5d95f033837c95db8b186219eae4ce3a
SSDEEP

1536:l0UJ3FnSqahPwdLNiEfqwnENBaGtyKksUT6yLWr:l13FhVznELFUT6B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9204381f4e4f4e2b28e6bff5f1c3b656_JaffaCakes118

Files

9204381f4e4f4e2b28e6bff5f1c3b656_JaffaCakes118
.exe windows:10 windows x86 arch:x86

d1d5a86303c5576f2dc14382d9a85202

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

api-ms-win-crt-locale-l1-1-0

_lock_locales

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-crt-runtime-l1-1-0

_c_exit

api-ms-win-crt-private-l1-1-0

wcsstr

api-ms-win-core-file-l1-1-0

WriteFile

api-ms-win-core-libraryloader-l1-1-0

FreeLibrary

api-ms-win-core-synch-l1-2-0

InitOnceComplete

api-ms-win-eventing-controller-l1-1-0

StartTraceW

api-ms-win-core-registry-l1-1-0

RegCloseKey

api-ms-win-core-synch-l1-1-0

SetEvent

api-ms-win-core-heap-l1-1-0

HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetLastError

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-com-l1-1-0

CoCreateGuid

api-ms-win-eventing-legacy-l1-1-0

QueryTraceW

api-ms-win-eventing-provider-l1-1-0

EventRegister

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW

api-ms-win-core-localization-l1-2-0

LCMapStringEx

api-ms-win-core-debug-l1-1-0

DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

VariantClear

api-ms-win-core-path-l1-1-0

PathCchCombine

crypt32

CryptStringToBinaryW

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

api-ms-win-core-string-l1-1-0

GetStringTypeW

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-memory-l1-1-0

MapViewOfFile

shell32

CommandLineToArgvW

winhttp

WinHttpOpen

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo

ntdll

RtlConvertDeviceFamilyInfoToString

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-registry-l2-1-0

RegSetKeyValueW

cryptsp

CryptHashData

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-file-l1-2-0

GetTempPathW

version

GetFileVersionInfoW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString

api-ms-win-core-winrt-l1-1-0

RoActivateInstance

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

wintrust

WinVerifyTrust

wininet

InternetOpenW

ext-ms-win-setupapi-classinstallers-l1-1-2

SetupIterateCabinetW

Sections

.MPRESS1
Size: 58KB - Virtual size: 304KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d1d5a86303c5576f2dc14382d9a85202

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-eventing-controller-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-eventing-legacy-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

oleaut32

api-ms-win-core-path-l1-1-0

crypt32

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-memory-l1-1-0

shell32

winhttp

api-ms-win-core-version-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

ntdll

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-registry-l2-1-0

cryptsp

api-ms-win-security-base-l1-1-0

api-ms-win-core-file-l1-2-0

version

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

wintrust

wininet

ext-ms-win-setupapi-classinstallers-l1-1-2

Sections

.MPRESS1 Size: 58KB - Virtual size: 304KB

.MPRESS2 Size: 7KB - Virtual size: 6KB

.rsrc Size: 7KB - Virtual size: 6KB

.MPRESS1
Size: 58KB - Virtual size: 304KB

.MPRESS2
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 7KB - Virtual size: 6KB