19706077e17081c06ec12b3e15807742_JaffaCakes118

General

Target

19706077e17081c06ec12b3e15807742_JaffaCakes118
Size

37KB
MD5

19706077e17081c06ec12b3e15807742
SHA1

783d0bfb154012301ddbd14ad02e2b633d7fb145
SHA256

3f5aa44842b1e74bd94a0ad41ad84a9d196efbc975507405fc6856969b8aa244
SHA512

16277c2b393e80b7bb8e5c9f228b5089ae3d75bc3840c2db236419710a5e601c2174db340b1026725662c23d1ead17ab4c6c98870ef5be6c16e82b6ab2d1f623
SSDEEP

768:zYKNXtC0KDM21Pp6P6OA9pggraRQVt8WmQf2Hvw5A5:0K5tC621tJ1btHmQDA5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
19706077e17081c06ec12b3e15807742_JaffaCakes118

Files

19706077e17081c06ec12b3e15807742_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bb6a96ba9314b9d4023b895296137516

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcmpA
GetProcAddress
LoadLibraryA
CloseHandle
WriteFile
CreateFileA
GetSystemDirectoryA
GetCurrentProcess
TerminateProcess
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
Thread32Next
TerminateThread
SuspendThread
OpenThread
Thread32First
GetLocalTime
LockResource
LoadResource
FindResourceA
MapViewOfFile
CreateFileMappingA
GetFileSize
UnmapViewOfFile
WritePrivateProfileSectionA
GetEnvironmentVariableA
DeviceIoControl
GetTempPathA
QueryPerformanceCounter
QueryPerformanceFrequency
MoveFileExA
CreateThread
GetModuleHandleA
WinExec
CreateDirectoryA
GetStartupInfoA
CopyFileA
Sleep
lstrcpyA
lstrcatA
GetFileAttributesA
MoveFileA
SetFileAttributesA
DeleteFileA
GetLogicalDrives
GetDriveTypeA
GetVolumeInformationA
SizeofResource
GetModuleFileNameA

user32

GetWindowTextA
GetParent
WindowFromPoint
PostMessageA
GetCursorPos

advapi32

RegOpenKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
StartServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
ControlService
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CreateServiceA

shell32

ShellExecuteA

msvcrt

__setusermatherr
_controlfp
_except_handler3
sprintf
fopen
rand
srand
time
fclose
fputs
strstr
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__set_app_type
_adjust_fdiv
__p__commode
__p__fmode

ws2_32

gethostbyname
WSACleanup
WSAStartup
gethostname

shlwapi

SHDeleteKeyA
PathAppendA

Sections

.data
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bb6a96ba9314b9d4023b895296137516

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

msvcrt

ws2_32

shlwapi

Sections

.data Size: 17KB - Virtual size: 16KB

.rsrc Size: 11KB - Virtual size: 11KB

.data
Size: 17KB - Virtual size: 16KB

.rsrc
Size: 11KB - Virtual size: 11KB