24c639a18297db41949983f59e4054fa_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

24c639a18297db41949983f59e4054fa_JaffaCakes118
Size

1.2MB
MD5

24c639a18297db41949983f59e4054fa
SHA1

999b084361f15698429f7d3c76462e2f45215161
SHA256

b90c45b593caa67d5c686b4c0ae43364be4fedcaf801c57cd08b39c8f66bc1ab
SHA512

4673629b812587745fb62d9a261b6487d7e5322dd57f109a70fc17d12621a8f6fb5c509f1f64b7253259cd9a801c34f5a207f043657f0641b23a76098e3bcc1a
SSDEEP

12288:eg8GBI8sEyF6O5O2xDTMuQQpRhO54snV80LLbmVSpcStKpq9gJvvUotI45Ce7rQo:e4BQEwlFTjgN/bm0Lf9EvUo75CePpTk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
24c639a18297db41949983f59e4054fa_JaffaCakes118

Files

24c639a18297db41949983f59e4054fa_JaffaCakes118
.exe windows:5 windows x64 arch:x64

99518ee85de51bc3e7e800671a75b81e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\src\mrs_adware\DefragAdw2\notify_loader_64\x64\Release\exe_64.pdb

Imports

shlwapi

PathAddBackslashW
StrCatW
wnsprintfW

wininet

InternetOpenW
InternetOpenUrlW
InternetReadFile
InternetCloseHandle
InternetSetOptionW

psapi

GetModuleFileNameExA
EnumProcesses

shell32

ShellExecuteExW
SHGetSpecialFolderPathW

kernel32

InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetModuleFileNameA
GetStdHandle
HeapAlloc
GetLocaleInfoA
HeapFree
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
GetTickCount
CopyFileW
GetModuleFileNameW
lstrlenW
GetTempPathW
lstrlenA
GetTempFileNameW
SetFilePointer
WriteFile
CloseHandle
Sleep
GetCurrentProcess
WaitForSingleObject
GetModuleHandleW
CreateRemoteThread
OpenProcess
VirtualFreeEx
TerminateProcess
GetLastError
SetLastError
lstrcmpiA
GetProcAddress
VirtualAllocEx
LocalAlloc
LocalFree
WriteProcessMemory
ExitProcess
MoveFileExW
GetVersionExW
WideCharToMultiByte
LCMapStringA
CreateFileW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentThreadId
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue

advapi32

RegCloseKey
RegCreateKeyW
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
RegSetValueExW

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
RtlVirtualUnwind

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

99518ee85de51bc3e7e800671a75b81e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

wininet

psapi

shell32

kernel32

advapi32

ntdll

Sections

.text Size: 20KB - Virtual size: 20KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 1.2MB - Virtual size: 1.2MB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 16B

.text
Size: 20KB - Virtual size: 20KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 1.2MB - Virtual size: 1.2MB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 16B