aec7ad6ac24d035bdf0fcf6eefb2d943_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

aec7ad6ac24d035bdf0fcf6eefb2d943_JaffaCakes118
Size

30KB
MD5

aec7ad6ac24d035bdf0fcf6eefb2d943
SHA1

83a6a195eccaf348285ea9588db0a0ee7ec0ba29
SHA256

6b218a9b1781a3ee7261292af28841b1a8c0bc874db4b5f4b0e3d9ca10171dc8
SHA512

b3f256823f801e6e2be27f6ccdf570d98bab9876b1cd5353093dcb01da9f942d8a5682a08ebc49cc17f891ab6da88ddf6c78082fa8f12c87489e7c583926a0ce
SSDEEP

384:2R2vA9cwbJWlUjDIW06oqEFn6A2FM0Wnifbhm4fUkr5X8gtNnOYm7vvxlLxWF9Wg:82vnwb2+DD08El6XFXR4qxVNnfm7DwP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aec7ad6ac24d035bdf0fcf6eefb2d943_JaffaCakes118

Files

aec7ad6ac24d035bdf0fcf6eefb2d943_JaffaCakes118
.exe windows:10 windows x86 arch:x86

ba22b3635e08a7c6956692ac89581061

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

msvcrt

exit

api-ms-win-core-registry-l1-1-0

RegFlushKey

api-ms-win-core-errorhandling-l1-1-0

SetLastError

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-file-l1-1-0

ReadFile

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-processthreads-l1-1-0

ExitProcess

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-processenvironment-l1-1-0

SearchPathW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-libraryloader-l1-2-0

LoadStringW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount

api-ms-win-core-registry-l2-1-0

RegSaveKeyW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrDupW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

ntdll

NtQueryKey

api-ms-win-core-localization-l1-2-0

FormatMessageW

ws2_32

WSACleanup

api-ms-win-core-console-l1-1-0

WriteConsoleW

api-ms-win-core-heap-l1-1-0

HeapSize

Sections

.MPRESS1
Size: 23KB - Virtual size: 324KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ba22b3635e08a7c6956692ac89581061

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

api-ms-win-core-registry-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-security-base-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

ntdll

api-ms-win-core-localization-l1-2-0

ws2_32

api-ms-win-core-console-l1-1-0

api-ms-win-core-heap-l1-1-0

Sections

.MPRESS1 Size: 23KB - Virtual size: 324KB

.MPRESS2 Size: 5KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 1KB

.MPRESS1
Size: 23KB - Virtual size: 324KB

.MPRESS2
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 1KB