2603256723ff148e2fdf859b38e11b32_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2603256723ff148e2fdf859b38e11b32_JaffaCakes118
Size

385KB
MD5

2603256723ff148e2fdf859b38e11b32
SHA1

84d7c7307fadea2dae920c3bfd4224365f91d2cc
SHA256

f7429d3c3584725bbf25b2bd3c9007e6a460f3181eca54090e0747c29146481f
SHA512

45e20c458aa3b33f8194175b698b2aae0cd352e2e4bdd88a99ff137975e6e27d2d4e411c561059cae5730aceac6597a4767db58dac8098366f62cd1fcd3dc160
SSDEEP

12288:sfoAPIuz9Nnnto8hT/y/RKjshxegypiVWpHl:sfoAnz9J+8hT/y/RDfeziWpHl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2603256723ff148e2fdf859b38e11b32_JaffaCakes118

Files

2603256723ff148e2fdf859b38e11b32_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e130e75322b459a3e34747d8b05f7073

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

swprintf
_vsnprintf
_onexit
__dllonexit
_except_handler3
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_adjust_fdiv
_initterm
_wtol
wcsstr
_wtoi
_wcsnicmp
_ftol
memmove
wcscmp
__RTDynamicCast
_purecall
realloc
__CxxFrameHandler
malloc
??2@YAPAXI@Z
free
??3@YAXPAX@Z

atl

ord21
ord18
ord22
ord23
ord15
ord32
ord30
ord16

kernel32

lstrlenW
GetModuleHandleW
IsBadWritePtr
GetProcAddress
LoadLibraryW
IsBadReadPtr
FreeLibrary
lstrcpynW
GetACP
TryEnterCriticalSection
lstrcmpW
IsBadStringPtrW
lstrcpyW
QueryPerformanceCounter
QueryPerformanceFrequency
CloseHandle
GetSystemTimeAsFileTime
SetEvent
RegisterWaitForSingleObject
UnregisterWait
CreateEventW
OutputDebugStringA
lstrcatA
GetLocalTime
HeapAlloc
GetProcessHeap
SetLastError
HeapFree
UnregisterWaitEx
WaitForSingleObject
WaitForMultipleObjects
CreateThread
QueueUserWorkItem
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
GetLastError
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
GetCurrentThreadId
EnterCriticalSection
SleepEx
LeaveCriticalSection
DisableThreadLibraryCalls

ole32

CoInitializeEx
CoUninitialize
IIDFromString
StringFromIID
CoCreateFreeThreadedMarshaler
CreateBindCtx
CLSIDFromString
StringFromCLSID
CoTaskMemFree
CoCreateInstance
StringFromGUID2

oleaut32

VariantClear
SysAllocString
SysFreeString
LoadRegTypeLi
SetErrorInfo
VariantInit
VariantCopy
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim

advapi32

RegOpenKeyExW
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
GetUserNameW
RegQueryValueExW

user32

GetWindowLongW
UnregisterClassW
DestroyWindow
DispatchMessageW
TranslateMessage
PeekMessageW
UnregisterDeviceNotification
MsgWaitForMultipleObjectsEx
RegisterDeviceNotificationW
CreateWindowExW
RegisterClassW
DefWindowProcW
LoadStringW
wsprintfA
SetWindowLongW

winmm

timeGetTime

rtutils

TraceRegisterExW
TraceVprintfExA
TraceDeregisterW

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.0e3c
Size: 512B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.1oqp
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.15as
Size: 512B - Virtual size: 182B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.a9as
Size: 512B - Virtual size: 170B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.klkl
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.psi
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.teta
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ks1
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.1231
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.1237
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.zetaa
Size: 347KB - Virtual size: 346KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.zeta0
Size: 512B - Virtual size: 202B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 210B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e130e75322b459a3e34747d8b05f7073

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

atl

kernel32

ole32

oleaut32

advapi32

user32

winmm

rtutils

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 2KB - Virtual size: 1KB

.0e3c Size: 512B - Virtual size: 236B

.1oqp Size: 512B - Virtual size: 176B

.15as Size: 512B - Virtual size: 182B

.a9as Size: 512B - Virtual size: 170B

.klkl Size: 512B - Virtual size: 56B

.psi Size: 512B - Virtual size: 56B

.teta Size: 512B - Virtual size: 92B

.ks1 Size: 512B - Virtual size: 144B

.1231 Size: 512B - Virtual size: 140B

.1237 Size: 512B - Virtual size: 140B

.zetaa Size: 347KB - Virtual size: 346KB

.zeta0 Size: 512B - Virtual size: 202B

.rsrc Size: 16KB - Virtual size: 15KB

.reloc Size: 512B - Virtual size: 210B

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 2KB - Virtual size: 1KB

.0e3c
Size: 512B - Virtual size: 236B

.1oqp
Size: 512B - Virtual size: 176B

.15as
Size: 512B - Virtual size: 182B

.a9as
Size: 512B - Virtual size: 170B

.klkl
Size: 512B - Virtual size: 56B

.psi
Size: 512B - Virtual size: 56B

.teta
Size: 512B - Virtual size: 92B

.ks1
Size: 512B - Virtual size: 144B

.1231
Size: 512B - Virtual size: 140B

.1237
Size: 512B - Virtual size: 140B

.zetaa
Size: 347KB - Virtual size: 346KB

.zeta0
Size: 512B - Virtual size: 202B

.rsrc
Size: 16KB - Virtual size: 15KB

.reloc
Size: 512B - Virtual size: 210B