2f32af131fc0e13e5e02092a57be8dbd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2f32af131fc0e13e5e02092a57be8dbd_JaffaCakes118
Size

158KB
MD5

2f32af131fc0e13e5e02092a57be8dbd
SHA1

a98c26affdec6540806204d5d03a1154cda98db5
SHA256

497020499865e2f039f3ee6eae82fd448cf682e01bc5ec33d570dc7fb94d24cd
SHA512

9dd93d3eb8dbadbe5e1ed1e5d29461d0c82a8321d9ad9a32d503b908a2f648d160365a5846690fb7d54bc4f6212e0a8e8d071b44a404a8c098b25dd5f478d61f
SSDEEP

3072:BjYMtuUz66p4KqdC4ZLQorYvlWCcEXcQqGfCSwGOkAoefFeOJDw:xt1G64KqM4ZEoTCctNGOloefFeOJDw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f32af131fc0e13e5e02092a57be8dbd_JaffaCakes118

Files

2f32af131fc0e13e5e02092a57be8dbd_JaffaCakes118
.exe windows:1 windows x86 arch:x86

9d6434b381a3796898e0ba9385795b89

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteW

kernel32

WriteFile
FreeLibraryAndExitThread
EnterCriticalSection
GetTickCount
GetLocaleInfoA
SystemTimeToTzSpecificLocalTime
CreateFileW
CloseHandle
DuplicateHandle
CopyFileA
GetCurrentProcess
GetSystemDefaultLCID
GetWindowsDirectoryA
SetStdHandle
lstrlenA
OpenJobObjectA
OpenProcess
VirtualFree
GetSystemDirectoryW
TransactNamedPipe
lstrcpyA
CreateJobSet
GetFileSizeEx
InitializeCriticalSection
GetLastError
Sleep
ReadFile
ReadConsoleOutputA
FindFirstFileA
VerLanguageNameW
GetProcAddress
GetSystemDirectoryA
GlobalFindAtomW
lstrcpyW
InitAtomTable
SetThreadLocale
GetDateFormatA
CreateSemaphoreA
GetModuleFileNameA
GetModuleHandleA
LeaveCriticalSection
SetVolumeMountPointA
FreeResource
GetStringTypeW
DeleteFileW
LockFileEx
CreateFileA
VirtualAlloc
MoveFileExW
FindNextFileA
HeapWalk
DeleteFileA
FindClose
lstrcatA
lstrcatW

advapi32

EnumServicesStatusA
RegQueryValueExA
RegCloseKey
OpenSCManagerA
ImpersonateNamedPipeClient
WmiQueryAllDataMultipleA
RegOpenKeyA
RegCreateKeyA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
LsaGetRemoteUserName
CloseServiceHandle
RegSetValueExA
GetInformationCodeAuthzLevelW
CryptEncrypt

ntdll

tolower
memset
RtlFreeUnicodeString
strstr
RtlAnsiStringToUnicodeString
strlen
RtlInitAnsiString
strncmp
memcpy
_chkstk
NtQueryObject
wcsstr
isspace
NtQuerySystemInformation
vsprintf
ZwLoadDriver
isdigit
sprintf

psapi

EnumProcesses
GetProcessImageFileNameA

ws2_32

recv
__WSAFDIsSet
gethostbyname
htons
select
socket
GetNameInfoW
connect
getpeername
WSAStartup
WSApSetPostRoutine
GetAddrInfoW
htonl
WSASendTo
closesocket
send

ole32

CoCreateGuid

user32

ExitWindowsEx
CharLowerW
UnhookWinEvent

Sections

.data
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 512B - Virtual size: 405B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9d6434b381a3796898e0ba9385795b89

Headers

File Characteristics

Imports

shell32

kernel32

advapi32

ntdll

psapi

ws2_32

ole32

user32

Sections

.data Size: 20KB - Virtual size: 20KB

.text Size: 512B - Virtual size: 405B

.idata Size: 3KB - Virtual size: 2KB

.data
Size: 20KB - Virtual size: 20KB

.text
Size: 512B - Virtual size: 405B

.idata
Size: 3KB - Virtual size: 2KB