a8633370145c08ed8be12ba3531ee2df_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a8633370145c08ed8be12ba3531ee2df_JaffaCakes118
Size

84KB
MD5

a8633370145c08ed8be12ba3531ee2df
SHA1

5ad1401b531361084fbfcda0e7cbed390324d330
SHA256

e2bddb444dd500357defb0247913e1bbf21d9fc5acd3208b1208714f21ed18df
SHA512

3128ef14f0b56784e2930c156b5e4ac8a4c62b4b16c2fec100f4d8673844e3d9f9148983609e5a93ba08fce0067878b7ab5209093a46be355cfb4e88ffb9f800
SSDEEP

1536:fgai7/RT2aEXvWT3MsZEYQGgp7NSYTQe8GPpMsUlqb:f8pqZfC1A7NkvKC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a8633370145c08ed8be12ba3531ee2df_JaffaCakes118

Files

a8633370145c08ed8be12ba3531ee2df_JaffaCakes118
.exe windows:6 windows x86 arch:x86

56d15a754eb04bd4dbfb46378e818635

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

StartServiceW
CryptDestroyHash
CryptImportKey
OpenSCManagerW
CryptGenKey
GetServiceDisplayNameW
ChangeServiceConfig2W
DuplicateTokenEx
CloseServiceHandle
CryptVerifySignatureW
RegCreateKeyExW
CryptDecrypt
CryptAcquireContextW
StartServiceCtrlDispatcherW
GetTokenInformation
RegisterServiceCtrlHandlerExW
SetServiceStatus
CryptCreateHash
GetLengthSid
CryptExportKey
OpenProcessToken
EnumServicesStatusExW
CryptGetHashParam
RevertToSelf
RegCloseKey
QueryServiceConfig2W
CryptDestroyKey
AdjustTokenPrivileges
RegSetValueExW
ImpersonateLoggedOnUser
CryptEncrypt
CryptReleaseContext
CreateProcessAsUserW
DuplicateToken
RegQueryValueExW
DeleteService
CryptDuplicateHash
LookupPrivilegeValueW
CreateServiceW
OpenServiceW

crypt32

CryptDecodeObjectEx

kernel32

CreateFileMappingW
DeleteFileW
VirtualProtectEx
GetProcessHeap
lstrcatW
CreateToolhelp32Snapshot
CreateProcessW
CreateFileW
FlushFileBuffers
MultiByteToWideChar
SetEvent
VirtualAllocEx
GetVolumeInformationW
GetThreadContext
WriteFile
GetProcAddress
HeapReAlloc
Process32FirstW
LocalFree
CreateMutexW
UnmapViewOfFile
WTSGetActiveConsoleSessionId
GetFileAttributesW
MapViewOfFile
LoadLibraryW
GetNativeSystemInfo
MoveFileExW
GetCurrentProcessId
lstrcmpiW
GetTempPathW
lstrcpynW
GetWindowsDirectoryW
ProcessIdToSessionId
CreateDirectoryW
VirtualQueryEx
CreateThread
HeapFree
LoadLibraryA
GetComputerNameW
WideCharToMultiByte
SetLastError
SetErrorMode
ExitProcess
SetFilePointer
VirtualFree
Process32NextW
VirtualAlloc
lstrcpyW
IsWow64Process
SetFileAttributesW
FreeLibrary
lstrlen
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
Sleep
GetModuleFileNameW
GetModuleHandleW
ResumeThread
TerminateProcess
GetLocalTime
GetCommandLineW
UnlockFileEx
GetTickCount
CreateEventW
SignalObjectAndWait
ReleaseMutex
LockFileEx
GetCurrentProcess
GetTempFileNameW
SetThreadContext
WaitForSingleObject
GetCurrentThreadId
WriteProcessMemory
GetLastError
lstrlenW
CopyFileW
ResetEvent
CloseHandle
GetFileSize

ntdll

RtlAllocateHeap
_snwprintf
_vsnprintf
NtUnmapViewOfSection
memcpy
RtlComputeCrc32
memset
_snprintf
_vsnwprintf
RtlGetVersion

shell32

SHFileOperationW
SHGetFolderPathW
ord409

urlmon

ObtainUserAgentString
ord92

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

wininet

InternetCrackUrlW
InternetSetOptionW
InternetSetStatusCallbackW
InternetCloseHandle
HttpQueryInfoW
HttpSendRequestW
InternetQueryOptionW
HttpEndRequestW
InternetReadFile
InternetConnectW
HttpOpenRequestW
InternetReadFileExW
HttpSendRequestExA
InternetReadFileExA
InternetOpenW

wtsapi32

WTSFreeMemory
WTSQueryUserToken
WTSEnumerateSessionsW

Sections

.text
Size: 51KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mackt
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

56d15a754eb04bd4dbfb46378e818635

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

crypt32

kernel32

ntdll

shell32

urlmon

userenv

wininet

wtsapi32

Sections

.text Size: 51KB - Virtual size: 52KB

.rdata Size: 2KB - Virtual size: 4KB

.data Size: 15KB - Virtual size: 16KB

.mackt Size: 12KB - Virtual size: 12KB

.text
Size: 51KB - Virtual size: 52KB

.rdata
Size: 2KB - Virtual size: 4KB

.data
Size: 15KB - Virtual size: 16KB

.mackt
Size: 12KB - Virtual size: 12KB