2bac879b6cdf577969d2f51d4e435289_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

2bac879b6cdf577969d2f51d4e435289_JaffaCakes118
Size

1.2MB
MD5

2bac879b6cdf577969d2f51d4e435289
SHA1

43aa7e2d78414085d1e049ac00f60a9e0c8daa0b
SHA256

41dddfdd1b3c91ef07760f678a34fe43d6f0466ec68eb07997960eadf37b4241
SHA512

b341fe00a4bcfbc70a80b5fba3e1bcb0b8b0fcfa2073a11c5c91764cbaa1f76c77a2a06628171018b8f09f386b73a144c0bf4762d27778f80d8d81f06d0b43e8
SSDEEP

24576:ewLRW45Pg4at6fBFHeFZH2Xm7UoaSkahXHLGyISBPaYy:rv44aQA122gVSFRBy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2bac879b6cdf577969d2f51d4e435289_JaffaCakes118

Files

2bac879b6cdf577969d2f51d4e435289_JaffaCakes118
.exe windows:5 windows x64 arch:x64

99518ee85de51bc3e7e800671a75b81e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\src\mrs_adware\DefragAdw2\notify_loader_64\x64\Release\exe_64.pdb

Imports

shlwapi

PathAddBackslashW
StrCatW
wnsprintfW

wininet

InternetOpenW
InternetOpenUrlW
InternetReadFile
InternetCloseHandle
InternetSetOptionW

psapi

GetModuleFileNameExA
EnumProcesses

shell32

ShellExecuteExW
SHGetSpecialFolderPathW

kernel32

InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetModuleFileNameA
GetStdHandle
HeapAlloc
GetLocaleInfoA
HeapFree
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
GetTickCount
CopyFileW
GetModuleFileNameW
lstrlenW
GetTempPathW
lstrlenA
GetTempFileNameW
SetFilePointer
WriteFile
CloseHandle
Sleep
GetCurrentProcess
WaitForSingleObject
GetModuleHandleW
CreateRemoteThread
OpenProcess
VirtualFreeEx
TerminateProcess
GetLastError
SetLastError
lstrcmpiA
GetProcAddress
VirtualAllocEx
LocalAlloc
LocalFree
WriteProcessMemory
ExitProcess
MoveFileExW
GetVersionExW
WideCharToMultiByte
LCMapStringA
CreateFileW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentThreadId
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue

advapi32

RegCloseKey
RegCreateKeyW
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
RegSetValueExW

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
RtlVirtualUnwind

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

99518ee85de51bc3e7e800671a75b81e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

wininet

psapi

shell32

kernel32

advapi32

ntdll

Sections

.text Size: 20KB - Virtual size: 20KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 1.2MB - Virtual size: 1.2MB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 16B

.text
Size: 20KB - Virtual size: 20KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 1.2MB - Virtual size: 1.2MB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 16B