273254cc80b89ed779d8972b8f24a0e3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

273254cc80b89ed779d8972b8f24a0e3_JaffaCakes118
Size

446KB
MD5

273254cc80b89ed779d8972b8f24a0e3
SHA1

9ab37cc4b2f04addfc95a76213edb78185d21005
SHA256

89614543668d27ec42ec336c920e140f8cace2f574cc4ec39c76f0cc963cd3bb
SHA512

b62debe61e71f79034ae24908e25501a180e7ac0e1651fc24fa79cbba8c09d21bdaa2e7dfc435cb6619bbb4c62ecab3fb655d39a18111d1b8ec5e961171602c5
SSDEEP

12288:qoI/6ePFRPTkmZDFlhToGV1+PLTnhy5p/uu1:qoI/6ILTkmZ3hVV1yLTA5p/uu1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
273254cc80b89ed779d8972b8f24a0e3_JaffaCakes118

Files

273254cc80b89ed779d8972b8f24a0e3_JaffaCakes118
.exe windows:5 windows x86 arch:x86

97b408f1819a5072fcfed27deb03a62c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

malloc
free
_except_handler3
realloc

atl

ord30
ord16
ord21
ord23
ord15
ord32
ord58
ord26
ord27
ord45
ord44
ord43
ord31

kernel32

DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
TlsFree
TlsAlloc
DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameA
GetProcAddress
LoadLibraryW
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
FlushInstructionCache
GetCurrentProcess
SetLastError
TlsSetValue
TlsGetValue
GetCurrentThreadId
lstrcatW
lstrcpyW
InterlockedCompareExchange
LoadLibraryA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapFree
GetProcessHeap
HeapAlloc
VirtualFree
VirtualAlloc
GetLastError
LocalFree
LocalAlloc
ExpandEnvironmentStringsW
CreateProcessW
CloseHandle
DelayLoadFailureHook
lstrlenW
lstrcpynW
GetWindowsDirectoryW
EnterCriticalSection
GetModuleHandleW

user32

GetClassInfoExW
LoadAcceleratorsW
GetKeyState
DestroyAcceleratorTable
IsWindow
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
RegisterClassExW
GetWindowLongW
SetWindowLongW
UnionRect
PtInRect
DestroyWindow
CreateWindowExW
DefWindowProcW
WaitForInputIdle
MapWindowPoints
SetWindowsHookExW
GetWindowRect
PostMessageW
SendMessageW
CallNextHookEx
UnhookWindowsHookEx
FindWindowW
BeginPaint
GetClientRect
EndPaint
GetParent
ShowWindow
GetFocus
IsChild
SetFocus
LoadStringW
CallWindowProcW
SetWindowPos
InvalidateRect

advapi32

RegCloseKey
RegOpenKeyExW

credui

CredUIReadSSOCredW

gdi32

RestoreDC
SetViewportOrgEx
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
GetDeviceCaps
CreateRectRgnIndirect
DeleteDC

ole32

OleRegGetUserType
CreateOleAdviseHolder
CoTaskMemFree
CoCreateInstance
OleRegEnumVerbs
IsAccelerator

oleaut32

OleCreatePropertyFrame
SysAllocStringLen
SysAllocString
SysStringLen
RegisterTypeLi
LoadTypeLi
VariantChangeType
SysStringByteLen
SysFreeString
VariantClear
LoadRegTypeLi

shlwapi

SHDeleteKeyW
SHGetValueW
ord437
ord193
StrCatBuffW
ord24

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xdata
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 274B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pasp
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.masm
Size: 512B - Virtual size: 138B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.kpack
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.kpamk
Size: 512B - Virtual size: 70B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

97b408f1819a5072fcfed27deb03a62c

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

atl

kernel32

user32

advapi32

credui

gdi32

ole32

oleaut32

shlwapi

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 107KB - Virtual size: 107KB

.data Size: 103KB - Virtual size: 103KB

.xdata Size: 103KB - Virtual size: 103KB

.tls Size: 103KB - Virtual size: 103KB

.pdata Size: 512B - Virtual size: 274B

.pasp Size: 512B - Virtual size: 156B

.masm Size: 512B - Virtual size: 138B

.kpack Size: 512B - Virtual size: 156B

.kpamk Size: 512B - Virtual size: 70B

.CRT Size: 512B - Virtual size: 8B

.rsrc Size: 16KB - Virtual size: 15KB

.reloc Size: 512B - Virtual size: 236B

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 107KB - Virtual size: 107KB

.data
Size: 103KB - Virtual size: 103KB

.xdata
Size: 103KB - Virtual size: 103KB

.tls
Size: 103KB - Virtual size: 103KB

.pdata
Size: 512B - Virtual size: 274B

.pasp
Size: 512B - Virtual size: 156B

.masm
Size: 512B - Virtual size: 138B

.kpack
Size: 512B - Virtual size: 156B

.kpamk
Size: 512B - Virtual size: 70B

.CRT
Size: 512B - Virtual size: 8B

.rsrc
Size: 16KB - Virtual size: 15KB

.reloc
Size: 512B - Virtual size: 236B