b7e4972169051fe392321f4dfdab7828_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b7e4972169051fe392321f4dfdab7828_JaffaCakes118
Size

1.3MB
MD5

b7e4972169051fe392321f4dfdab7828
SHA1

5da5ff0090a8f014a01794fa00529ecbcbfc3a67
SHA256

6690c0589b90abcb5f9840e0898b8d9acf7352c3e8e6f0d79b223929eb198a7e
SHA512

11563e99fe85d930df7c52f33384e998a3ce2c5370a75b823e44fa46d65508e24319b1a067c9937075d828713b0f22c7a859fa28bf116804e370db349c5ca1c7
SSDEEP

24576:pfUDUqfsc/2bNJho9Z7Bwz8bt7qn1FpUmOm5zH+9GgKl129UHkrotJg:p8Aqfsc4J4bwjpUmOm5S9GgMHztJg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b7e4972169051fe392321f4dfdab7828_JaffaCakes118

Files

b7e4972169051fe392321f4dfdab7828_JaffaCakes118
.exe windows:5 windows x86 arch:x86

8b14f3732f15f29e8235a66f8bf42ca6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

N:\700\tptp\alive2_18\Release\alive2.pdb

Imports

advapi32

OpenProcessToken
ConvertSidToStringSidA
RegCreateKeyExW
RegQueryValueExA
RegQueryValueExW
RegQueryInfoKeyW
LookupAccountNameW
LookupPrivilegeValueW
RegDeleteValueW
RegOpenKeyExW
RegEnumKeyExW
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
DeregisterEventSource
RegisterEventSourceA
ReportEventA

shell32

SHGetFolderPathW
ShellExecuteA

kernel32

CreateFileA
GetFileSize
CreateMutexW
FindFirstFileW
SetFilePointer
FreeLibrary
CreateProcessW
GetCurrentProcess
WaitForSingleObject
GetComputerNameW
ConnectNamedPipe
GetTickCount
CreateNamedPipeW
GetSystemTimeAsFileTime
WriteFile
OpenProcess
WideCharToMultiByte
LoadLibraryW
Sleep
GetVersionExW
GetExitCodeProcess
CreateProcessA
TerminateProcess
ReadFile
GetModuleFileNameW
CreateFileW
ExitThread
MultiByteToWideChar
lstrlenW
GetLastError
GetCurrentDirectoryW
SetLastError
GetProcAddress
FindClose
LoadLibraryA
Process32FirstW
IsWow64Process
Process32NextW
CreateToolhelp32Snapshot
ReleaseMutex
CloseHandle
DeleteFileW
GetCurrentProcessId
LocalFree
DeleteFileA
CreateThread
CreateDirectoryW
GetFileAttributesW
GetFileInformationByHandle
GetFileType
SetEndOfFile
SetFileAttributesW
SetFileTime
DeviceIoControl
IsValidCodePage
ExitProcess
GetOEMCP
GetFileAttributesA
GetFullPathNameW
PeekNamedPipe
HeapAlloc
HeapFree
GetProcessHeap
GetStdHandle
SearchPathA
DuplicateHandle
SetHandleInformation
CreatePipe
GetCurrentThreadId
GetVersion
GetModuleHandleA
QueryPerformanceCounter
GlobalMemoryStatus
FlushConsoleInputBuffer
SetEnvironmentVariableA
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
SwitchToThread
HeapDestroy
HeapReAlloc
HeapCreate
LocalAlloc
GetSystemDirectoryW
GetModuleHandleW
LoadLibraryExW
OutputDebugStringW
HeapSize
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetConsoleCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
ReadConsoleW
FlushFileBuffers
GetACP
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
RaiseException
SetConsoleMode
ReadConsoleInputA
GetConsoleMode
SetConsoleCtrlHandler
SetFilePointerEx
SetStdHandle
RemoveDirectoryW
AreFileApisANSI
GetModuleHandleExW
GetCommandLineW
IsProcessorFeaturePresent
IsDebuggerPresent
GetCPInfo
GetStringTypeW
DecodePointer
EncodePointer
WriteConsoleW

user32

PostMessageW
EnumWindows
GetWindowThreadProcessId
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
WaitForInputIdle
EnumDisplayDevicesW

psapi

GetProcessMemoryInfo

winhttp

WinHttpReceiveResponse
WinHttpSetOption
WinHttpSendRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpOpenRequest
WinHttpReadData

bcrypt

BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptEncrypt
BCryptDestroyKey
BCryptDeriveKeyPBKDF2
BCryptCreateHash
BCryptFinishHash
BCryptHashData

Exports

Exports

LZ4_attach_dictionary
LZ4_compress
LZ4_compressBound
LZ4_compress_continue
LZ4_compress_default
LZ4_compress_destSize
LZ4_compress_fast
LZ4_compress_fast_continue
LZ4_compress_fast_extState
LZ4_compress_fast_extState_fastReset
LZ4_compress_limitedOutput
LZ4_compress_limitedOutput_continue
LZ4_compress_limitedOutput_withState
LZ4_compress_withState
LZ4_create
LZ4_createStream
LZ4_createStreamDecode
LZ4_decoderRingBufferSize
LZ4_decompress_fast
LZ4_decompress_fast_continue
LZ4_decompress_fast_usingDict
LZ4_decompress_fast_withPrefix64k
LZ4_decompress_safe
LZ4_decompress_safe_continue
LZ4_decompress_safe_partial
LZ4_decompress_safe_usingDict
LZ4_decompress_safe_withPrefix64k
LZ4_freeStream
LZ4_freeStreamDecode
LZ4_loadDict
LZ4_resetStream
LZ4_resetStreamState
LZ4_resetStream_fast
LZ4_saveDict
LZ4_setStreamDecode
LZ4_sizeofState
LZ4_sizeofStreamState
LZ4_slideInputBuffer
LZ4_uncompress
LZ4_uncompress_unknownOutputSize
LZ4_versionNumber
LZ4_versionString
NvOptimusEnablementCuda

Sections

.text
Size: 1007KB - Virtual size: 1006KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 265KB - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8b14f3732f15f29e8235a66f8bf42ca6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

shell32

kernel32

user32

psapi

winhttp

bcrypt

Exports

Exports

Sections

.text Size: 1007KB - Virtual size: 1006KB

.rdata Size: 265KB - Virtual size: 265KB

.data Size: 14KB - Virtual size: 54KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 44KB - Virtual size: 43KB

.text
Size: 1007KB - Virtual size: 1006KB

.rdata
Size: 265KB - Virtual size: 265KB

.data
Size: 14KB - Virtual size: 54KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 44KB - Virtual size: 43KB