2e87184455cbd45fbd2911d3c04a0b60_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2e87184455cbd45fbd2911d3c04a0b60_JaffaCakes118
Size

420KB
MD5

2e87184455cbd45fbd2911d3c04a0b60
SHA1

76e1754a9c8fa1fce89fa39c6ad3e7fdbcd91210
SHA256

cb6e3a9ad353332a6cfa6da7eb8ab0729bfd65332aa654c2452fb8230a362e42
SHA512

dc8fbbebb1746bac0c8df1d24fb1e46409d7c86dd08298a9bb003ce799f95790f7308607f5e5abaef86313d6b3f4a35306baa22e5e5f034690242fcb54e063fc
SSDEEP

12288:ivOjfxdq4ooBDCEJQlfTpc9RJEHcxuGET7/:ivqnTooBVJQdck8o/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2e87184455cbd45fbd2911d3c04a0b60_JaffaCakes118

Files

2e87184455cbd45fbd2911d3c04a0b60_JaffaCakes118
.exe windows:5 windows x86 arch:x86

1909f76b05a0f7afc2d83456d3e78988

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

free
wcscat
wcsncpy
calloc
wcscpy
__CxxFrameHandler
wcsstr
wcstok
_snwprintf
wcslen
_itow
wcsncat

msvcp60

?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z

advapi32

RegCloseKey
RegOpenKeyW
RegDeleteValueW
RegCreateKeyExW
RegCreateKeyW
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
ControlService

kernel32

InterlockedIncrement
InterlockedDecrement
CloseHandle
GetCurrentProcess
DeleteFileW
UnmapViewOfFile
HeapFree
MapViewOfFile
CreateFileMappingW
GetFileSize
CreateFileW
WriteFile
VirtualFree
DisableThreadLibraryCalls
VirtualAlloc
ReadFile
HeapAlloc
GetProcessHeap

netsh.exe

PrintMessageFromModule
RegisterHelper
PrintMessage
PrintError
MatchToken
MatchEnumTag
RegisterContext

ole32

CoTaskMemAlloc
CoCreateInstance
CoInitializeEx
CoUninitialize
CoTaskMemFree

oleaut32

SysAllocString
SysFreeString
SysStringLen
SysStringByteLen
SysAllocStringLen

shlwapi

SHGetValueW

userenv

ExpandEnvironmentStringsForUserW

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.9e3c
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.1o2p
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.16as
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.aeas
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.k1kl
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ps1i
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t3ta
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ksi1
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.12i1
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.123f
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eaa
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ze
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.1teaX
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.134
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.724
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.182
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.381
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.832
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ii32
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.i832
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.i833
Size: 512B - Virtual size: 222B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.i803
Size: 512B - Virtual size: 222B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1909f76b05a0f7afc2d83456d3e78988

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

msvcp60

advapi32

kernel32

netsh.exe

ole32

oleaut32

shlwapi

userenv

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 1KB

.9e3c Size: 512B - Virtual size: 216B

.1o2p Size: 512B - Virtual size: 216B

.16as Size: 512B - Virtual size: 216B

.aeas Size: 512B - Virtual size: 216B

.k1kl Size: 512B - Virtual size: 216B

.ps1i Size: 512B - Virtual size: 216B

.t3ta Size: 512B - Virtual size: 216B

.ksi1 Size: 512B - Virtual size: 216B

.12i1 Size: 512B - Virtual size: 216B

.123f Size: 512B - Virtual size: 216B

.eaa Size: 124KB - Virtual size: 123KB

.ze Size: 124KB - Virtual size: 123KB

.1teaX Size: 124KB - Virtual size: 123KB

.134 Size: 512B - Virtual size: 216B

.724 Size: 512B - Virtual size: 216B

.182 Size: 512B - Virtual size: 216B

.381 Size: 512B - Virtual size: 216B

.832 Size: 512B - Virtual size: 216B

.ii32 Size: 512B - Virtual size: 216B

.i832 Size: 512B - Virtual size: 216B

.i833 Size: 512B - Virtual size: 222B

.i803 Size: 512B - Virtual size: 222B

.rsrc Size: 16KB - Virtual size: 15KB

.reloc Size: 512B - Virtual size: 300B

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 1KB

.9e3c
Size: 512B - Virtual size: 216B

.1o2p
Size: 512B - Virtual size: 216B

.16as
Size: 512B - Virtual size: 216B

.aeas
Size: 512B - Virtual size: 216B

.k1kl
Size: 512B - Virtual size: 216B

.ps1i
Size: 512B - Virtual size: 216B

.t3ta
Size: 512B - Virtual size: 216B

.ksi1
Size: 512B - Virtual size: 216B

.12i1
Size: 512B - Virtual size: 216B

.123f
Size: 512B - Virtual size: 216B

.eaa
Size: 124KB - Virtual size: 123KB

.ze
Size: 124KB - Virtual size: 123KB

.1teaX
Size: 124KB - Virtual size: 123KB

.134
Size: 512B - Virtual size: 216B

.724
Size: 512B - Virtual size: 216B

.182
Size: 512B - Virtual size: 216B

.381
Size: 512B - Virtual size: 216B

.832
Size: 512B - Virtual size: 216B

.ii32
Size: 512B - Virtual size: 216B

.i832
Size: 512B - Virtual size: 216B

.i833
Size: 512B - Virtual size: 222B

.i803
Size: 512B - Virtual size: 222B

.rsrc
Size: 16KB - Virtual size: 15KB

.reloc
Size: 512B - Virtual size: 300B