2b640c58ccf150825b320413bac02636_JaffaCakes118

General

Target

2b640c58ccf150825b320413bac02636_JaffaCakes118
Size

279KB
MD5

2b640c58ccf150825b320413bac02636
SHA1

5e8935a4965174889d43fa0bbb8e53ad489a8d56
SHA256

cafe508c0da9d3dbd39ecf3ba20e51b10da87755e9b15fadf79ccb27417acb8d
SHA512

520acd02d97b411377a43c681a921bc53ea99fa054cdc6134cdf71ba11bbb232e8c3551af0b84ddbb8e664e1aab7b9e09344e2f9a91d3ac3d1368f23cee696fe
SSDEEP

6144:Q05IoFJ9rWTpxk+gKl4yDF/AFxuwjLlTZV:Q05v1+xoGFwuwXl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b640c58ccf150825b320413bac02636_JaffaCakes118

Files

2b640c58ccf150825b320413bac02636_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fddec09cb99656757f9bbbc74135e771

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_DragLeave
ImageList_DragMove
ImageList_DragEnter

newdev

UpdateDriverForPlugAndPlayDevicesW

shlwapi

StrCmpNIA
StrStrA

iphlpapi

GetIpAddrTable

shell32

SHGetFolderPathW

kernel32

AddAtomA
InterlockedIncrement
IsBadWritePtr
LoadResource
LockResource
TerminateThread
GetTickCount
GetLastError
MultiByteToWideChar
ReleaseSemaphore
GetExitCodeThread
EnterCriticalSection
WaitForMultipleObjects
GetProcAddress
LoadLibraryA
GetModuleFileNameA
GetThreadPriority
FindResourceA
CreateFileW
LeaveCriticalSection
CreateMutexA
ReleaseMutex
EnumResourceTypesA
WideCharToMultiByte
GetCurrentThread
CreateSemaphoreA
IsBadReadPtr
ResetEvent
GetModuleFileNameW
GetSystemInfo
VirtualAlloc
GetPrivateProfileStructA
SetThreadPriority
Sleep
InterlockedDecrement
GlobalAlloc
HeapFree
GetSystemTime
GetProcessHeap
QueryPerformanceCounter
VirtualFree
GetCurrentProcessId
DisableThreadLibraryCalls
FreeLibrary
LoadLibraryW
lstrlenA
GetCurrentThreadId
ExitProcess

setupapi

CM_Get_Sibling
CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status

Sections

.text
Size: 137KB - Virtual size: 272KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fddec09cb99656757f9bbbc74135e771

Headers

File Characteristics

Imports

comctl32

newdev

shlwapi

iphlpapi

shell32

kernel32

setupapi

Sections

.text Size: 137KB - Virtual size: 272KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 138KB - Virtual size: 138KB

.rsrc Size: 512B - Virtual size: 4KB

.text
Size: 137KB - Virtual size: 272KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 138KB - Virtual size: 138KB

.rsrc
Size: 512B - Virtual size: 4KB