2ceb1b2e293029f80a06bd243c9dd9a2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2ceb1b2e293029f80a06bd243c9dd9a2_JaffaCakes118
Size

231KB
MD5

2ceb1b2e293029f80a06bd243c9dd9a2
SHA1

18fb360d4514c1ab84a23e582d98a36d4c37f97b
SHA256

2dafc043e48fbc0fbeaf553d1f968f73e3942220b4d34bd152eac3df8e3b29ca
SHA512

015eff8217ef08493b8b85855c1f986c01906071318bb33a2a326e65dce03c6d4c1e73ae9c728170fb28e5b3a2f0f3d8c3e5d6344ab0a9124ccf9be148c092dd
SSDEEP

6144:usOtRAj6+u1a6GYx7DPVtLs5J9DDDVeIuvqKa80EOzx:Oc6+u1Jtc5LVcs80EOzx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ceb1b2e293029f80a06bd243c9dd9a2_JaffaCakes118

Files

2ceb1b2e293029f80a06bd243c9dd9a2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c06fc95a953fd176b63970a0240aa2d6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

mapi32

MAPIOpenFormMgr

ole32

CoUninitialize
CoInitialize
CoCreateInstance
PropVariantClear

shlwapi

SHStrDupA
SHDeleteKeyA
SHDeleteKeyW

kernel32

ExitProcess
GetCPInfo
WriteConsoleW
SetStdHandle
GetLocaleInfoA
InterlockedExchange
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetProcessHeaps
SetCurrentDirectoryA
MultiByteToWideChar
HeapValidate
LeaveCriticalSection
HeapUnlock
DeleteFileA
GetFileType
GetCurrentDirectoryA
GetCurrentThread
CreateProcessA
GetVersionExA
WriteFile
CloseHandle
RemoveDirectoryA
GetLastError
GetFullPathNameW
FindNextFileA
ExitThread
Sleep
ExpandEnvironmentStringsA
CopyFileA
CreateThread
GetCurrentProcessId
LCMapStringW
LoadLibraryA
FreeEnvironmentStringsW
TlsFree
lstrlenA
SetEnvironmentVariableA
HeapSize
WaitForSingleObject
SetFilePointer
MoveFileExA
FlushFileBuffers
GetFileAttributesExA
ResumeThread
GetCurrentProcess
GetTimeZoneInformation
GetStringTypeW
WaitForMultipleObjects
SetConsoleCtrlHandler
GetStringTypeA
GetCommandLineA
LoadLibraryExW
IsValidCodePage
InterlockedCompareExchange
GetExitCodeProcess
LCMapStringA
VirtualFree
GetProcAddress
ExitProcess
CompareStringA
GetDriveTypeA
GetCurrentThreadId
FindClose
HeapLock
GetConsoleWindow
HeapWalk
ReadConsoleInputA
GetModuleFileNameA
RaiseException
GetACP
RtlUnwind
EnterCriticalSection
SetLastError
SetConsoleTitleA
FreeEnvironmentStringsA
SetEvent
GetTickCount
CreateFileA
VirtualQuery
GlobalLock
HeapAlloc
DebugBreak
GetLocalTime
SetUnhandledExceptionFilter
WideCharToMultiByte
UnhandledExceptionFilter
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStrings
GetThreadPriority
GetFileSize
GetProcessHeap
GetFileAttributesW
InitializeCriticalSection
HeapReAlloc
GetNumberOfConsoleInputEvents
InterlockedIncrement
GetFileAttributesA
GlobalUnlock
OpenProcess
CompareStringW
GlobalAlloc
GetStdHandle
GetOEMCP
LocalFree
HeapDestroy
SetEndOfFile
GetConsoleOutputCP
CreateDirectoryW
CreateEventA
GetStartupInfoA
SetFileAttributesA
TlsSetValue
HeapFree
VirtualAlloc
InterlockedDecrement
FindFirstFileA
SetHandleCount
TlsGetValue
GetModuleFileNameW
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
TlsAlloc
OutputDebugStringA
CreateFileW
ReadFile
HeapCreate
CreateDirectoryA
GetConsoleMode
LoadLibraryExA
WriteConsoleA
DeleteCriticalSection
FreeLibrary
IsDebuggerPresent
GetModuleHandleA
TerminateProcess

shell32

SHGetMalloc
ShellExecuteA
SHGetFolderPathA
SHGetSpecialFolderPathA

user32

DialogBoxParamA
GetDlgItem
GetCursorPos
GetWindowTextLengthA
GetDlgItemInt
EndDialog
EmptyClipboard
IsWindowVisible
wsprintfA
SetDlgItemTextA
GetDesktopWindow
MessageBoxA
ShowWindow
GetKeyState
SetClipboardData
EnumWindowStationsW
SetDlgItemInt
GetWindowThreadProcessId
EnumWindows
DdeDisconnect
ScreenToClient
GetWindowRect
OpenClipboard
SetWindowPos
PeekMessageA
CloseClipboard

advapi32

OpenServiceA
RegDeleteValueA
RegCloseKey
StartServiceA
QueryServiceStatus
OpenSCManagerA
RegisterServiceCtrlHandlerA
DeleteService
RegEnumValueA
RegisterEventSourceA
RegSetValueExA
SetEntriesInAclA
SetSecurityDescriptorDacl
CreateServiceA
GetSecurityDescriptorDacl
QueryServiceStatusEx
RegOpenKeyExW
RegQueryInfoKeyA
RegQueryValueExA
CloseServiceHandle
InitializeSecurityDescriptor
ConvertStringSidToSidA
LookupPrivilegeValueA
OpenProcessToken
RegEnumKeyExW
SetNamedSecurityInfoA
ChangeServiceConfigA
RegOpenKeyExA
ChangeServiceConfig2A
RegCreateKeyExA
SetServiceObjectSecurity
DeregisterEventSource
StartServiceCtrlDispatcherA
ControlService
RegEnumKeyExA
SetServiceStatus
ReportEventA
QueryServiceObjectSecurity
AdjustTokenPrivileges

Sections

.text
Size: 205KB - Virtual size: 205KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.denue
Size: 5KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c06fc95a953fd176b63970a0240aa2d6

Headers

File Characteristics

Imports

mapi32

ole32

shlwapi

kernel32

shell32

user32

advapi32

Sections

.text Size: 205KB - Virtual size: 205KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 100KB - Virtual size: 100KB

.denue Size: 5KB - Virtual size: 72KB

.text
Size: 205KB - Virtual size: 205KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 100KB - Virtual size: 100KB

.denue
Size: 5KB - Virtual size: 72KB