26f21ca7206e3c6ac0f73a4fa7a112a2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

26f21ca7206e3c6ac0f73a4fa7a112a2_JaffaCakes118
Size

186KB
MD5

26f21ca7206e3c6ac0f73a4fa7a112a2
SHA1

3188abc4852eb20558371c322b02e7a29469bd91
SHA256

1a6733eee06e134919ab10be02d1ab6b3cfdabddf50e8a1ea8887dc6079ac55e
SHA512

9b93cd20a71181904253f8d6bc8aa359efd7252cf5dde0887828fae40e85ad3c1a492d183a9672b029d6a6b08af42d16ae7924c9eda6058ba1caa5937c73596b
SSDEEP

3072:66eZ97C56RrRvFQPGM0+nukW215x8+nzfAM0JBvokGkbb7kACYvnrFKnf+nx:66a9G56jKPGeNrBfA7KDYvronfQx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
26f21ca7206e3c6ac0f73a4fa7a112a2_JaffaCakes118

Files

26f21ca7206e3c6ac0f73a4fa7a112a2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5c78768545f2ebd4707bdafd72d869bb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

ChangeServiceConfig2A
FreeSid
LookupAccountSidA
LookupPrivilegeValueA
QueryServiceConfig2A
RegEnumValueA
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA

kernel32

AddAtomA
CloseHandle
CreateEventA
CreateFileA
CreateFileMappingA
CreateProcessA
DeviceIoControl
DuplicateHandle
EnumSystemLocalesA
ExitProcess
ExitThread
FileTimeToLocalFileTime
FindClose
FindResourceA
FormatMessageA
FreeLibrary
GetConsoleCP
GetConsoleMode
GetCurrentDirectoryA
GetCurrentProcessId
GetCurrentThreadId
GetDriveTypeA
GetFileAttributesA
GetFileSize
GetFileType
GetFullPathNameA
GetLastError
GetModuleFileNameA
GetPrivateProfileStringA
GetProcessHeap
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetTempFileNameA
GetThreadLocale
GetThreadTimes
GetTickCount
GetTimeZoneInformation
GetVersionExA
GlobalAlloc
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
LoadLibraryExA
LocalFree
Module32First
Module32Next
MoveFileA
MoveFileExA
MultiByteToWideChar
OpenEventA
QueryPerformanceCounter
ReleaseMutex
RtlUnwind
SearchPathA
SetEndOfFile
SetFileTime
SetHandleCount
SetLastError
SetUnhandledExceptionFilter
SizeofResource
SuspendThread
SystemTimeToFileTime
TlsFree
TlsGetValue
TlsSetValue
VirtualAlloc
VirtualFree
VirtualProtect
WriteFile
WritePrivateProfileStringA
lstrcatA
lstrlenA

user32

CharPrevA
DefWindowProcA
DestroyMenu
DrawFocusRect
EnableWindow
EndPaint
FindWindowA
GetClientRect
GetCursorPos
GetDC
GetDlgItemTextA
GetForegroundWindow
GetMessageA
GetWindowRect
IsChild
IsWindowEnabled
IsWindowVisible
LoadBitmapA
LoadCursorA
MessageBeep
MessageBoxA
SetDlgItemTextA
SetRect
UpdateWindow
WinHelpA
wsprintfA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Sections

.text
Size: 25KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.INIT
Size: 137KB - Virtual size: 324KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5c78768545f2ebd4707bdafd72d869bb

Headers

File Characteristics

Imports

advapi32

kernel32

user32

version

Sections

.text Size: 25KB - Virtual size: 28KB

.INIT Size: 137KB - Virtual size: 324KB

.data Size: 512B - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.idata Size: 3KB - Virtual size: 4KB

.edata Size: 15KB - Virtual size: 16KB

.text
Size: 25KB - Virtual size: 28KB

.INIT
Size: 137KB - Virtual size: 324KB

.data
Size: 512B - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.idata
Size: 3KB - Virtual size: 4KB

.edata
Size: 15KB - Virtual size: 16KB