2ab385232d6648f8d902127df01123e1_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

2ab385232d6648f8d902127df01123e1_JaffaCakes118
Size

64KB
MD5

2ab385232d6648f8d902127df01123e1
SHA1

21001c1879974a591b821e7a8a24dc22991b8280
SHA256

bd570f36e3660acce0c78312079c19eb8fd76abcbbee3f0bfa7e3d1dbbe7a642
SHA512

dc378be7e705bd409a0ec6eb6f6f8bb2c5e749c6da7a73edad3c904210cc7593a20393a7b96da2bd4716e0710c3bc105590a3758884de5f05580c08f81c54642
SSDEEP

768:5gwcoGbdYywNmcLE6uJ8HvK+mRkDUQ0NQMcBh:LnGbdyNmutHvpEHNQMah

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ab385232d6648f8d902127df01123e1_JaffaCakes118

Files

2ab385232d6648f8d902127df01123e1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

432c5998e0ce6a650cd87a2af7e311f7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

SafeArrayDestroy
SysFreeString
SysAllocString
VariantClear
SafeArrayCreate
VariantInit

rpcrt4

RpcImpersonateClient
UuidCreate
RpcRevertToSelf

iphlpapi

GetTcpTable
GetAdaptersAddresses
GetIpAddrTable
NotifyRouteChange
GetUdpTable
GetIpForwardTable
GetIpNetTable
SendARP
GetAdaptersInfo
NotifyAddrChange

kernel32

WriteFile
FormatMessageW
SizeofResource
LoadResource
lstrlenA
EnterCriticalSection
FindResourceW
SetFilePointer
SetFileAttributesW
DeleteCriticalSection
UnhandledExceptionFilter
GetSystemTimeAsFileTime
FindResourceExW
RaiseException
HeapAlloc
DeleteFileW
DeviceIoControl
SetEndOfFile
GetCurrentThreadId
LocalAlloc
FreeLibrary
WideCharToMultiByte
WaitForSingleObject
LockResource
GetFileSize
SetUnhandledExceptionFilter
CreateEventW
LeaveCriticalSection
ReadFile
ReleaseSemaphore
HeapFree
GetProcessHeap
GetSystemTime
SetLastError
HeapReAlloc
IsDebuggerPresent
LoadLibraryExW
HeapDestroy
CreateFileW
lstrlenW
HeapSize
CloseHandle
CreateSemaphoreW
DisableThreadLibraryCalls
FileTimeToSystemTime
OpenProcess
GetACP
GetFullPathNameA
VirtualAllocEx

shlwapi

PathAddBackslashW

user32

MsgWaitForMultipleObjects
PeekMessageW
TranslateMessage
DispatchMessageW

ws2_32

WSAStartup
inet_addr
ntohs
WSACleanup

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx

advapi32

RegOpenKeyExW
GetSidSubAuthority
GetTraceLoggerHandle
RegisterTraceGuidsW
CloseServiceHandle
QueryServiceConfigW
GetTraceEnableLevel
OpenProcessToken
GetSidSubAuthorityCount
OpenSCManagerW
OpenServiceW
RegQueryValueExW
GetTokenInformation
TraceMessage
StartServiceW
RegCloseKey
GetTraceEnableFlags
QueryServiceStatusEx
ControlTraceW
RegSetValueExW
UnregisterTraceGuids
ControlService

hlink

HlinkCreateBrowseContext
HlinkQueryCreateFromData
HlinkCreateExtensionServices
HlinkOnNavigate
HlinkGetSpecialReference
DllRegisterServer

mssip32

DllUnregisterServer
CryptSIPVerifyIndirectData
CryptSIPCreateIndirectData

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.kClRdBs
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cVTtabs
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.WItwcMs
Size: 512B - Virtual size: 373B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.nQkPKTU
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 255KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.yoWqzTU
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.kigfzvU
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hCZCzvU
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.kTgFbZU
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.seLfbZU
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

432c5998e0ce6a650cd87a2af7e311f7

Headers

DLL Characteristics

File Characteristics

Imports

oleaut32

rpcrt4

iphlpapi

kernel32

shlwapi

user32

ws2_32

ole32

advapi32

hlink

mssip32

Sections

.text Size: 20KB - Virtual size: 19KB

.kClRdBs Size: 4KB - Virtual size: 3KB

.cVTtabs Size: 3KB - Virtual size: 2KB

.rdata Size: 3KB - Virtual size: 11KB

.WItwcMs Size: 512B - Virtual size: 373B

.nQkPKTU Size: 3KB - Virtual size: 2KB

.data Size: 7KB - Virtual size: 255KB

.yoWqzTU Size: 3KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 3KB

.kigfzvU Size: 3KB - Virtual size: 3KB

.hCZCzvU Size: 2KB - Virtual size: 2KB

.kTgFbZU Size: 4KB - Virtual size: 4KB

.seLfbZU Size: 4KB - Virtual size: 4KB

.text
Size: 20KB - Virtual size: 19KB

.kClRdBs
Size: 4KB - Virtual size: 3KB

.cVTtabs
Size: 3KB - Virtual size: 2KB

.rdata
Size: 3KB - Virtual size: 11KB

.WItwcMs
Size: 512B - Virtual size: 373B

.nQkPKTU
Size: 3KB - Virtual size: 2KB

.data
Size: 7KB - Virtual size: 255KB

.yoWqzTU
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 3KB

.kigfzvU
Size: 3KB - Virtual size: 3KB

.hCZCzvU
Size: 2KB - Virtual size: 2KB

.kTgFbZU
Size: 4KB - Virtual size: 4KB

.seLfbZU
Size: 4KB - Virtual size: 4KB