19e5528d5b56ce08c6f801dc46d3bd31_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

19e5528d5b56ce08c6f801dc46d3bd31_JaffaCakes118
Size

104KB
MD5

19e5528d5b56ce08c6f801dc46d3bd31
SHA1

269f1328b915b94a88454370cfc5e7be809d9f8c
SHA256

457544522f9c27ca6b45da621393d750f7a6549b1d989565d1804b1cc6827354
SHA512

e49de03f0389a058c469f91bd65deb4d7029696454c519897f25bb7346f6dcbd32a6274138135d5e0006948ca9d8dfee4cde1b63a98a60646f4d289748628e2e
SSDEEP

3072:bCsfrUSixH8y4w7qwHmGp233P8SziE7e0NVoKH+:b7rUSip8y4wW3GpOXzT7PzH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
19e5528d5b56ce08c6f801dc46d3bd31_JaffaCakes118

Files

19e5528d5b56ce08c6f801dc46d3bd31_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ee940f39ab66a6b7703d921f0c0f5dc5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

SetPropA
ReleaseDC
RegisterClassA
GetWindowLongA
GetPropA
GetDoubleClickTime
GetDlgItemTextA
GetDC
GetClientRect
GetCapture
FrameRect
ExitWindowsEx
EnumChildWindows
DrawEdge
CloseClipboard

netapi32

NetDfsManagerSendSiteInfo
NetLocalGroupSetInfo
NetReplExportDirEnum
NetShareDel
NetUserEnum

oleaut32

SysReAllocString
SysStringLen
SafeArrayDestroy
RevokeActiveObject
OleTranslateColor
OleLoadPicture
OleIconToCursor
GetErrorInfo

dbghelp

SymGetModuleBase
SymGetLineFromAddr64
SymEnumerateSymbolsW
FindDebugInfoFileEx

shlwapi

ColorHLSToRGB
PathAddExtensionA
PathFindFileNameW
PathIsUNCServerA
AssocQueryKeyA
ChrCmpIA

advapi32

CreateProcessAsUserW
ElfOpenEventLogA
LookupPrivilegeNameA
LsaClearAuditLog
RegUnLoadKeyW
SetFileSecurityA
SetPrivateObjectSecurity
SetSecurityDescriptorRMControl
SetServiceStatus
AddAuditAccessObjectAce

kernel32

WriteFileEx
SetUnhandledExceptionFilter
SetTapeParameters
SetEvent
HeapCreate
HeapAlloc
GetVolumeInformationA
GetVersionExW
GetVersionExA
GetStartupInfoA
GetModuleHandleA
GetCommandLineA
FoldStringA
FindVolumeMountPointClose
FindFirstVolumeW
CancelTimerQueueTimer
CloseHandle
EnumResourceNamesA
EnumSystemLanguageGroupsW
ExitProcess
AssignProcessToJobObject

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ee940f39ab66a6b7703d921f0c0f5dc5

Headers

File Characteristics

Imports

user32

netapi32

oleaut32

dbghelp

shlwapi

advapi32

kernel32

Sections

.text Size: 64KB - Virtual size: 63KB

.data Size: 28KB - Virtual size: 27KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 64KB - Virtual size: 63KB

.data
Size: 28KB - Virtual size: 27KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 3KB