2efde827568edd831f35fdef95b6f928_JaffaCakes118

General

Target

2efde827568edd831f35fdef95b6f928_JaffaCakes118
Size

61KB
MD5

2efde827568edd831f35fdef95b6f928
SHA1

71d27b4d72c73eaac3c73f934ab5d9f7a08bf696
SHA256

44f6d9d69dabadffdbe9ed9d1f22b1d6ee91e68c80533440dea1259d13def512
SHA512

363d364f6b63c0dcdc7b4e6e1cf0db280e5314f51161cf8f1925026f7801b085ad612034054c354337849e494d44a5c008eb1110bd6ece8da42cd7b8bd7b4f29
SSDEEP

1536:mQukdXE/rXMEJEsJeU/LQ2eRtY9D32XoWpAQUN:KkdkeK/LQ2eRsD3CoWSXN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2efde827568edd831f35fdef95b6f928_JaffaCakes118

Files

2efde827568edd831f35fdef95b6f928_JaffaCakes118
.exe windows:5 windows x86 arch:x86

11c67b9272883cbc628fe729c2fb650b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlUnwind
strncpy
memcpy
strrchr
ZwQuerySystemInformation
RtlInitAnsiString
RtlAnsiStringToUnicodeString
memset
_snprintf
RtlInitUnicodeString
ZwUnloadDriver
ZwLoadDriver
_stricmp

shlwapi

PathCombineA
PathFindFileNameA
PathAppendW
PathAppendA

kernel32

GlobalMemoryStatusEx
DeviceIoControl
GetModuleFileNameA
ExitProcess
MoveFileExA
GetSystemDirectoryA
GetLocalTime
SystemTimeToFileTime
MapViewOfFile
CloseHandle
CreateFileMappingA
CreateFileA
UnmapViewOfFile
Process32Next
Process32First
CreateToolhelp32Snapshot
GetLastError
GetCurrentProcess
VirtualUnlock
VirtualLock
MultiByteToWideChar
WriteFile
SetFileTime
GetVersionExA
LoadLibraryA
GetModuleHandleA
GetTickCount
GetCurrentProcessId
GetVolumeInformationA
GetWindowsDirectoryA
WriteProcessMemory
VirtualAllocEx
GetProcAddress
VirtualFreeEx
CreateRemoteThread
OpenProcess
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
WideCharToMultiByte
GetSystemDirectoryW
Sleep

user32

ExitWindowsEx
GetDesktopWindow

advapi32

RegEnumKeyA
LookupPrivilegeValueA
RegDeleteValueA
RegQueryValueExA
RegOpenKeyExA
AdjustTokenPrivileges
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dyndata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

11c67b9272883cbc628fe729c2fb650b

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

shlwapi

kernel32

user32

advapi32

shell32

Sections

.text Size: 13KB - Virtual size: 13KB

.dyndata Size: 47KB - Virtual size: 47KB

.text
Size: 13KB - Virtual size: 13KB

.dyndata
Size: 47KB - Virtual size: 47KB