0154b7052d9bce7d6a68f6a52ed7ec23_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0154b7052d9bce7d6a68f6a52ed7ec23_JaffaCakes118
Size

177KB
MD5

0154b7052d9bce7d6a68f6a52ed7ec23
SHA1

0b017d2bebce28a8b365cfa456f9304ac77fde05
SHA256

241b51e2c8a8f7bf8604060e45298f997d71ac56a52f861e1dc175f5383c43b6
SHA512

f9cfd8e0ea909a9007e00cfc37aa09ce24ff88ce07ff685065b6a2216cd265aec5314ef3ea2e125f135195cbf41b1920c849ad790423b5152e09f199fb9f6ead
SSDEEP

3072:5hk1tzi5859xyxqdiI8xS9q9RkNrJyovlggc4BEoYHxhR4NsG4pZfSCLvA62yUMR:V585bYquL9R+JyovTJ2R4Ns1hSYv4dMR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0154b7052d9bce7d6a68f6a52ed7ec23_JaffaCakes118

Files

0154b7052d9bce7d6a68f6a52ed7ec23_JaffaCakes118
.exe windows:5 windows x86 arch:x86

7b682a7ff2f35ae05fb81920c2b0f3ab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

_lwrite
GetUserDefaultLangID
ReadFile
TlsFree
RemoveDirectoryA
lstrcpynA
SetErrorMode
CreateEventA
FreeResource
CloseHandle
_lclose
SetFileTime
VirtualQuery
SetLocalTime
CompareStringW
IsBadCodePtr
SystemTimeToFileTime
GetCurrentProcess
EnterCriticalSection
ExitThread
GetCPInfo
SetHandleCount
UnhandledExceptionFilter
GetModuleFileNameA
WriteFile
GetTickCount
CreateProcessW
CreateSemaphoreA
GetFileTime
FindClose
SetEndOfFile
CreateFileA
lstrlenA
WideCharToMultiByte
GetStartupInfoA
TerminateProcess
GlobalHandle
GetStdHandle
HeapReAlloc
GetExitCodeProcess
HeapAlloc
CreateDirectoryA
GetVersionExA
FileTimeToLocalFileTime
GetOEMCP
GetProcAddress
LoadLibraryA
GetCommandLineA
GetLastError
GetDateFormatA
DeleteFileA
FlushInstructionCache
GetCurrentProcessId
CreateProcessA
GetEnvironmentStrings
HeapCreate
FileTimeToSystemTime
FreeEnvironmentStringsA
FindResourceA
_llseek
GlobalUnlock
LoadResource
GetStringTypeW
GetCurrentDirectoryA
GetDriveTypeA
GetTempPathA
GetACP
GlobalReAlloc
FreeEnvironmentStringsW
HeapDestroy
GetProfileStringA
FormatMessageA
TlsAlloc
GetTempFileNameA
SetLastError
lstrcatA
lstrcmpiW
GetSystemTime
FormatMessageW
ReleaseSemaphore
GetFullPathNameA
GetUserDefaultLCID
GetEnvironmentStringsW
lstrcmpA
GetStringTypeA
LCMapStringA
GlobalFree
GetSystemDirectoryA
GetShortPathNameA
LoadLibraryExA
GlobalAddAtomA
SetEvent
LockResource
ResetEvent
lstrcmpiA
IsDBCSLeadByte
WinExec
SetEnvironmentVariableA
GetVersion
CreateThread
InterlockedDecrement
GlobalSize
MultiByteToWideChar
GetSystemInfo
HeapSize
SizeofResource
GetFileType
FlushFileBuffers
InitializeCriticalSection
SetFileAttributesA
lstrcpyA
Sleep
GlobalLock
TlsGetValue
VirtualAlloc
CompareStringA
GetFileAttributesA
GetModuleHandleA
DuplicateHandle
MulDiv
SearchPathA
SetStdHandle
LCMapStringW
DeleteCriticalSection
ResumeThread
GetModuleFileNameW
GetTimeZoneInformation
TlsSetValue
InterlockedIncrement
VirtualFree
GetVolumeInformationA
LockFile
GetLocalTime
IsBadReadPtr
FindNextFileA
RtlUnwind
GetSystemDefaultLCID
LeaveCriticalSection
FreeLibrary
GetLocaleInfoA
_lread
ExitProcess
GetWindowsDirectoryA
RaiseException
GetSystemDefaultLangID
GlobalAlloc
GlobalDeleteAtom
MoveFileA
VirtualProtect
HeapFree
SetCurrentDirectoryA
WaitForSingleObject
SetFilePointer
GetStringTypeExA
GetCurrentThreadId
FindFirstFileA
UnlockFile

samlib

SamLookupNamesInDomain
SamConnectWithCreds
SamConnect

ws2_32

setsockopt
WSAConnect

advapi32

RegDeleteKeyW
RegOpenKeyExA
RegOpenKeyA
RegEnumValueA
RegSetValueExW
AdjustTokenPrivileges
RegSetValueA
RegDeleteKeyA
RegQueryValueExW
RegEnumKeyA
SetSecurityDescriptorDacl
RegCloseKey
InitializeSecurityDescriptor
RegCreateKeyA
OpenProcessToken
RegQueryInfoKeyA
RegisterEventSourceA
LookupPrivilegeValueA
ReportEventA
RegCreateKeyW
RegDeleteValueW
RegDeleteValueA
DeregisterEventSource
RegQueryValueA
RegSetValueExA
RegEnumValueW
RegOpenKeyW
RegEnumKeyW
RegQueryValueExA

ole32

OleLoad
OleSave

ddraw

DirectDrawEnumerateA

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 140KB - Virtual size: 368KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7b682a7ff2f35ae05fb81920c2b0f3ab

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

samlib

ws2_32

advapi32

ole32

ddraw

Sections

.text Size: 1KB - Virtual size: 1KB

.idata Size: 5KB - Virtual size: 5KB

.data Size: 140KB - Virtual size: 368KB

.rsrc Size: 26KB - Virtual size: 26KB

.rdata Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 64B

.text
Size: 1KB - Virtual size: 1KB

.idata
Size: 5KB - Virtual size: 5KB

.data
Size: 140KB - Virtual size: 368KB

.rsrc
Size: 26KB - Virtual size: 26KB

.rdata
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 64B