29d6359e29e930d4544984f0d939b266_JaffaCakes118

General

Target

29d6359e29e930d4544984f0d939b266_JaffaCakes118
Size

185KB
MD5

29d6359e29e930d4544984f0d939b266
SHA1

2a2c30af4723ea66cb8c459b8317637473dbc2eb
SHA256

22263eeedf3a6c96bc6b55dec1c03d2c6f88b71f56796d3c68b2aa87e3dfb23d
SHA512

519aaef0216b10144cccc8a9d74ff36445d14d64006cb4f4914858997a8a220e7d193f133f0716c8b744e684c11fb17b4c2e7a5d146ef512502eaf423202f3b7
SSDEEP

3072:LWMaXtJDMkKuHfpefTuR+zmRpAqa3DoiWzqQZO2pJEOeleBMUIIT:LWM+lMk/BefU+zmsqazSfRvele4U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29d6359e29e930d4544984f0d939b266_JaffaCakes118

Files

29d6359e29e930d4544984f0d939b266_JaffaCakes118
.exe windows:4 windows x86 arch:x86

eda053fae0b5f85f90305b59b0709811

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

iphlpapi

GetIpAddrTable

newdev

UpdateDriverForPlugAndPlayDevicesW

kernel32

TlsAlloc
TerminateProcess
FreeEnvironmentStringsA
SetLastError
GetSystemInfo
HeapDestroy
AddAtomA
InterlockedExchange
IsBadWritePtr
VirtualFree
GetVersionExA
VirtualAlloc
GetCPInfo
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleFileNameA
TlsSetValue
TlsFree
GetLocaleInfoA
EnumResourceLanguagesA
GetCurrentProcessId
FreeEnvironmentStringsW
SetEndOfFile
VirtualQuery
GetFileType
GetEnvironmentStringsW
GetOEMCP
lstrcpyW
TlsGetValue
GetStartupInfoA
HeapCreate
HeapSize
UnhandledExceptionFilter
GetStdHandle
WriteFile
GetCurrentProcess
GetEnvironmentStrings
SetHandleCount
GetACP
SetUnhandledExceptionFilter

mprapi

MprConfigServerDisconnect
MprConfigServerConnect
MprConfigGetFriendlyName

setupapi

CM_Get_Parent
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

shell32

SHGetFolderPathW

user32

GetDlgItem
SendMessageA
DestroyWindow
CreateWindowExW
IsWindow
EnumChildWindows
GetWindowThreadProcessId

Sections

.text
Size: 93KB - Virtual size: 237KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eda053fae0b5f85f90305b59b0709811

Headers

File Characteristics

Imports

iphlpapi

newdev

kernel32

mprapi

setupapi

shell32

user32

Sections

.text Size: 93KB - Virtual size: 237KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 88KB - Virtual size: 87KB

.rsrc Size: 512B - Virtual size: 4KB

.text
Size: 93KB - Virtual size: 237KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 88KB - Virtual size: 87KB

.rsrc
Size: 512B - Virtual size: 4KB