27ffa1aa13bd8a233b947c22b7380541_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

27ffa1aa13bd8a233b947c22b7380541_JaffaCakes118
Size

312KB
MD5

27ffa1aa13bd8a233b947c22b7380541
SHA1

48a491d6f65a3b18086a49aff65c7acd7ef8a0fd
SHA256

08dbbd7e7f811f612fffef7e454ddf7bf64d3a7571251cfcffbba84e4f18065e
SHA512

57cda87130cc4b38a9521d05cd853eed11e131accb0e1d540373a284a068e57aaaa8b8639fa686899e7f1581b8126378fe9b6242d26586fce1c0d2c649254707
SSDEEP

6144:BS2Xzv5MjOblAaGCUJK/sWn59b+MKxE0HW81CIlf15dMaley4V:BnG7csW59hwH/1bDzMWey4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27ffa1aa13bd8a233b947c22b7380541_JaffaCakes118

Files

27ffa1aa13bd8a233b947c22b7380541_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5ec024fd437c64fb0e76202f69bbb965

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetDiskFreeSpaceExA
VirtualAlloc
lstrcmpA
CreateProcessA
GetTempPathW
CloseHandle
GetFileInformationByHandle
ReadFile
ConnectNamedPipe
WaitNamedPipeA
ClearCommBreak
GetShortPathNameW
CompareStringW
SetFileTime
SetProcessShutdownParameters
SetupComm
EnumResourceNamesA
EnumResourceLanguagesW
RaiseException
GetVersionExA
AllocConsole
PeekNamedPipe
EnumCalendarInfoA
GetCurrentDirectoryW
SetConsoleWindowInfo
GetDateFormatA
_hread
FreeResource
EnumSystemCodePagesW
ExitProcess
MultiByteToWideChar
SetProcessAffinityMask
GetLongPathNameA
SetNamedPipeHandleState
GetCommState
IsBadStringPtrA
lstrcmpiA
SetConsoleOutputCP
EnumSystemCodePagesA
_llseek
GenerateConsoleCtrlEvent
WritePrivateProfileSectionW
GetCommandLineA
VirtualProtect
Beep

user32

SetKeyboardState
SetMenuDefaultItem

gdi32

EndPage
CreateFontIndirectW
GetObjectA
SetSystemPaletteUse
EndDoc
RectVisible
Polyline
SetViewportOrgEx

advapi32

GetLengthSid
CryptSignHashW
QueryServiceObjectSecurity
IsValidSecurityDescriptor
EnumServicesStatusA
StartServiceCtrlDispatcherW
DeregisterEventSource
AccessCheck
FreeSid
DestroyPrivateObjectSecurity
EnumDependentServicesA

shell32

SHGetSettings
ExtractIconA
DragQueryPoint
FindExecutableA

ole32

OleCreate
OleConvertIStorageToOLESTREAM
OleSetContainedObject
GetRunningObjectTable
CoDisconnectObject

oleaut32

VariantCopy
LoadTypeLibEx
SafeArrayUnaccessData
SafeArrayGetLBound
LoadTypeLi
SetErrorInfo
SafeArrayGetElement
SysFreeString

comctl32

ImageList_SetBkColor
CreateStatusWindowW
CreateToolbarEx

shlwapi

PathRemoveBlanksW
ChrCmpIW
PathIsNetworkPathW
SHSetValueA
StrChrIA
PathAppendA
SHCreateStreamOnFileW
PathGetCharTypeW
SHRegCloseUSKey

setupapi

SetupDiOpenDeviceInfoW
SetupDiGetClassDescriptionW
SetupDiBuildDriverInfoList
SetupCloseInfFile
SetupDiGetDeviceRegistryPropertyA
SetupDiSetSelectedDevice

Sections

.text
Size: 292KB - Virtual size: 291KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5ec024fd437c64fb0e76202f69bbb965

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

shlwapi

setupapi

Sections

.text Size: 292KB - Virtual size: 291KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 12KB - Virtual size: 8KB

.text
Size: 292KB - Virtual size: 291KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 8KB