abe5ba6f171ff8f2d5edf40957b52e3d_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

abe5ba6f171ff8f2d5edf40957b52e3d_JaffaCakes118
Size

944KB
MD5

abe5ba6f171ff8f2d5edf40957b52e3d
SHA1

dedec4d9bd3425564a6a3d1dd0055b478ffca86b
SHA256

eba516e043bcb59183b3d3bf48e75c3b7e158f1446b219ca1b63ef31b769b7ff
SHA512

afbc66634b0c376d880746419f16ed27235906d986b44ff6a3a6e1eea884dbe350ae4316e98bb61e0d7ba293e16bc3b95ac5562524c7ebf9dde3f62e4422d7a6
SSDEEP

24576:6SsAZkp5IRBGLpGLMMMHMMMvMMZMMMKzbKXOMMHMMMvMMZMMMKzbKX7GLMMMHMMF:lsAZ+I2MMHMMMvMMZMMMFOMMHMMMvMMk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
abe5ba6f171ff8f2d5edf40957b52e3d_JaffaCakes118

Files

abe5ba6f171ff8f2d5edf40957b52e3d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

1de96e04b8cf648c695cf7847dcd42c6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winhttp

WinHttpOpen
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpReadData
WinHttpCloseHandle
WinHttpConnect
WinHttpSendRequest
WinHttpOpenRequest

psapi

GetModuleFileNameExW
EnumProcessModules
GetModuleBaseNameW

ws2_32

gethostbyname
send
closesocket
socket
htons
WSAStartup
connect

kernel32

GetStringTypeW
LCMapStringW
SetStdHandle
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
GetLocaleInfoW
InterlockedExchange
QueryPerformanceCounter
GetEnvironmentStringsW
ExitProcess
lstrlenA
GetTickCount
WideCharToMultiByte
Sleep
lstrcmpiA
CreateThread
WriteFile
CreateFileW
MultiByteToWideChar
GetLastError
CloseHandle
OpenProcess
GlobalAlloc
CreateDirectoryA
CopyFileA
SetFileAttributesA
Process32FirstW
LocalAlloc
GetModuleFileNameA
Process32NextW
CreateMutexA
GetUserDefaultLCID
GetCurrentProcessId
DeleteFileA
GetThreadContext
CreateFileA
GetFileSize
SetThreadContext
SetFilePointer
ReadProcessMemory
CreateProcessA
ReadFile
VirtualAlloc
VirtualAllocEx
WriteProcessMemory
ResumeThread
GetCurrentProcess
IsWow64Process
GetSystemInfo
Thread32First
TerminateProcess
Thread32Next
GetProcAddress
OpenThread
GetModuleHandleA
SuspendThread
FreeEnvironmentStringsW
RtlUnwind
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapCreate
DeleteCriticalSection
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
InitializeCriticalSection
SetEndOfFile
GetProcessHeap
CreateToolhelp32Snapshot
InitializeCriticalSectionAndSpinCount
SetHandleCount
InterlockedDecrement
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapSize
LoadLibraryW
WriteConsoleW
GetFileType
GetStdHandle
GetModuleFileNameW
EncodePointer
DecodePointer
HeapFree
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
RaiseException
GetModuleHandleW

user32

RegisterClassExW
GetWindowTextA
CreateWindowExW
EnumDisplayDevicesW
CharToOemW
UnregisterClassW
GetForegroundWindow
DefWindowProcW

advapi32

RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetKernelObjectSecurity
RegSetValueExA
RegOpenKeyExW
RegQueryValueExW
GetUserNameW

shell32

ShellExecuteW
ShellExecuteA

ole32

CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoCreateInstance

oleaut32

VariantInit
VariantClear

urlmon

URLOpenBlockingStreamA

Sections

.text
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 757KB - Virtual size: 756KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1de96e04b8cf648c695cf7847dcd42c6

Headers

DLL Characteristics

File Characteristics

Imports

winhttp

psapi

ws2_32

kernel32

user32

advapi32

shell32

ole32

oleaut32

urlmon

Sections

.text Size: 138KB - Virtual size: 137KB

.rdata Size: 31KB - Virtual size: 30KB

.data Size: 7KB - Virtual size: 14KB

.reloc Size: 10KB - Virtual size: 10KB

.rsrc Size: 757KB - Virtual size: 756KB

.text
Size: 138KB - Virtual size: 137KB

.rdata
Size: 31KB - Virtual size: 30KB

.data
Size: 7KB - Virtual size: 14KB

.reloc
Size: 10KB - Virtual size: 10KB

.rsrc
Size: 757KB - Virtual size: 756KB