279e0ac1676db742926db4f0cbec1f2b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

279e0ac1676db742926db4f0cbec1f2b_JaffaCakes118
Size

3.7MB
MD5

279e0ac1676db742926db4f0cbec1f2b
SHA1

a03eb7fdcba92ffd7e079e0f9a1441a6e5663f86
SHA256

46531c34f42db710329b7d5d8bdcf2771d35ecf7a9e2af311c3816f9d287cf20
SHA512

ff32dfc8615e2ea91e6620141c05533aa186ca5260505dc8e6a51fb7eea67f7d4f5b0e72f9193751f38ea5408f1ed275956bfbb22543b39da1238619661f8514
SSDEEP

98304:2PFiLgHEenAfd/WGNvpxLusmddB00RngGvun6YK:2SuEvlOCusm+AgU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
279e0ac1676db742926db4f0cbec1f2b_JaffaCakes118

Files

279e0ac1676db742926db4f0cbec1f2b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

215c35187ea8ee35fecb40685e1df41a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadDirectoryChangesW
VirtualAllocEx
VirtualLock
GetStartupInfoA
SetFileTime
RemoveDirectoryA
SetProcessAffinityMask
DeleteCriticalSection
SystemTimeToFileTime
GetModuleHandleA
GlobalFindAtomW
SetConsoleTitleA
GetFileInformationByHandle
GetCurrentDirectoryW
FatalAppExitA
GetCommandLineW
EnumSystemCodePagesA
VirtualProtect
GetTapeStatus
GetWindowsDirectoryA
WritePrivateProfileSectionW
GetCompressedFileSizeW
GetTempPathW
ReadFile
CreateIoCompletionPort
EnumCalendarInfoW
SetFileAttributesA
PrepareTape
FindFirstFileW
ReadFileScatter
SetCurrentDirectoryA
SetTimeZoneInformation
RaiseException
ReadConsoleOutputA
lstrcpyA
DuplicateHandle
DebugBreak
CreateDirectoryA
LoadLibraryExW
EnumResourceLanguagesW
ExitProcess

user32

UnhookWindowsHook
LoadImageW
CreateWindowStationW
SendDlgItemMessageA
GetMessageTime
GetSubMenu
DestroyMenu
UnregisterClassA
SetLastErrorEx
TrackMouseEvent
EndPaint
DrawTextExA
GetWindowContextHelpId
ShowCaret
UnionRect
CallNextHookEx
MapVirtualKeyExW
GetWindowRgn
DialogBoxIndirectParamW
CloseDesktop
ShowCursor
GetProcessWindowStation
SendMessageCallbackW
SetUserObjectInformationW
TranslateMessage
GetKeyboardLayoutNameA
LoadKeyboardLayoutW
CallWindowProcA
SetScrollRange
EnumDesktopWindows
UnregisterClassW
SetScrollPos

comctl32

ImageList_SetImageCount

advapi32

OpenSCManagerA
SetEntriesInAclW
ControlService
RegEnumValueA
LookupAccountSidA
CryptDeriveKey
RegEnumValueW
RegEnumKeyExW
ReportEventW
CryptSetProvParam
InitializeAcl
SetEntriesInAclA
RegLoadKeyW
RegRestoreKeyA
RegQueryInfoKeyW

version

VerQueryValueA

msvcrt

_isatty
_open_osfhandle
_close
_ultoa
wcstombs
_dup2
_fdopen
_tzset
fgetc
_wcsicoll
_pipe

Sections

.text
Size: 14KB - Virtual size: 233KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

215c35187ea8ee35fecb40685e1df41a

Headers

File Characteristics

Imports

kernel32

user32

comctl32

advapi32

version

msvcrt

Sections

.text Size: 14KB - Virtual size: 233KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 3.5MB - Virtual size: 3.5MB

.rsrc Size: 19KB - Virtual size: 18KB

.text
Size: 14KB - Virtual size: 233KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 3.5MB - Virtual size: 3.5MB

.rsrc
Size: 19KB - Virtual size: 18KB