1bced6319358f60260ad018823113e94_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

1bced6319358f60260ad018823113e94_JaffaCakes118
Size

166KB
MD5

1bced6319358f60260ad018823113e94
SHA1

3893afe5173aa90f53a59916c0c0912d4cd7becc
SHA256

dba7b30682401e40fea5a14bc858d934261459a0e274e274f38844a3ea36bd6e
SHA512

a18774da3009d6589a22c0892698b0883537d75db8fe2487418f1f5795fe62f751315454025f6456582d410c840c72de618ba65975a7411cd9c098213bbb724b
SSDEEP

3072:x7REZ965OTO7K31z0g+W6THqiPFVtiof8Nc7hN1S15K73Aag:xGXtKGZ0b/TNPFVtii2gemm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1bced6319358f60260ad018823113e94_JaffaCakes118

Files

1bced6319358f60260ad018823113e94_JaffaCakes118
.exe windows:5 windows x64 arch:x64

e96a73c7bf33a464c510ede582318bf2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

psapi

GetModuleInformation

advapi32

CloseServiceHandle
OpenThreadToken
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetTokenInformation
NotifyChangeEventLog
OpenEventLogA
GetNumberOfEventLogRecords
GetOldestEventLogRecord
ReadEventLogA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
QueryServiceStatus
CreateServiceA
OpenSCManagerA
DeleteService
OpenServiceA
StartServiceA
ControlService
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
RegCloseKey
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegQueryValueExA

secur32

LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions

ws2_32

ntohl
ntohs
htonl

kernel32

CreateEventA
CreateFileW
GetProcessHeap
SetEndOfFile
WriteConsoleW
SetEnvironmentVariableA
CompareStringW
DeleteFileA
GetModuleHandleA
OpenProcess
Sleep
SetConsoleCtrlHandler
GetCurrentDirectoryA
GetTempPathA
GetVersionExA
ProcessIdToSessionId
GetCurrentProcessId
GetModuleFileNameA
GetCurrentProcess
LoadLibraryA
IsBadReadPtr
Process32Next
CloseHandle
Process32First
CreateToolhelp32Snapshot
ReadProcessMemory
WaitForSingleObject
CreateRemoteThread
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
GetProcAddress
TerminateProcess
MultiByteToWideChar
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateFileA
SizeofResource
LockResource
LoadResource
FindResourceA
FreeResource
ResetEvent
GetLastError
ReadFile
FreeLibrary
GetSystemWindowsDirectoryA
SetEvent
CreateThread
WriteFile
WaitNamedPipeA
FlushFileBuffers
DisconnectNamedPipe
ConnectNamedPipe
CreateNamedPipeA
WideCharToMultiByte
FileTimeToSystemTime
FileTimeToLocalFileTime
GetCurrentThread
GetModuleHandleW
ExitProcess
DecodePointer
HeapFree
HeapAlloc
EncodePointer
EnterCriticalSection
LeaveCriticalSection
HeapReAlloc
GetCommandLineA
RtlUnwindEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
LoadLibraryW
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
GetModuleFileNameW
HeapSetInformation
GetVersion
HeapCreate
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetFilePointer
SetStdHandle
LCMapStringW
GetStringTypeW

Sections

.text
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e96a73c7bf33a464c510ede582318bf2

Headers

DLL Characteristics

File Characteristics

Imports

psapi

advapi32

secur32

ws2_32

kernel32

Sections

.text Size: 122KB - Virtual size: 121KB

.rdata Size: 17KB - Virtual size: 16KB

.data Size: 22KB - Virtual size: 33KB

.pdata Size: 4KB - Virtual size: 4KB

.rsrc Size: 42KB - Virtual size: 42KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 122KB - Virtual size: 121KB

.rdata
Size: 17KB - Virtual size: 16KB

.data
Size: 22KB - Virtual size: 33KB

.pdata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 42KB - Virtual size: 42KB

.reloc
Size: 1KB - Virtual size: 1KB