2face6eda38d921c9ee4c32e5173863e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2face6eda38d921c9ee4c32e5173863e_JaffaCakes118
Size

25KB
MD5

2face6eda38d921c9ee4c32e5173863e
SHA1

fa91fc981b6beeddc345c059afe06d83a38b4d61
SHA256

8aa58cd4d0eda874584fdd72f33f782754d3e50ce7b6fed3031b73c2a5a2094d
SHA512

c6dde9eaec82bc3855d979110444267789dd2c3406656d75e1be13f68ff2c274fd317ddb4e014638c4521cb5700e9d38a7a3dac7f7448137147865908c63d83a
SSDEEP

384:l1aUpLs4bpAy2OlYL9OhGDaeAxuG5bU+RvAb1tnHrPUUwHsmHFDH:l1hpLHbhG3Wz5Q2WdrPmlT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2face6eda38d921c9ee4c32e5173863e_JaffaCakes118

Files

2face6eda38d921c9ee4c32e5173863e_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b9839d2cb3aab47690133d62188f5ef8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathAppendW

urlmon

ObtainUserAgentString

wininet

InternetOpenA
InternetOpenUrlA
HttpQueryInfoA
InternetCloseHandle
InternetGetConnectedState
InternetQueryDataAvailable
InternetReadFile

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
strtok
??2@YAPAXI@Z
wcsrchr
strncpy
sprintf
printf
??3@YAXPAX@Z
strstr
_stricmp
_vsnprintf
_snprintf
memset

kernel32

WriteProcessMemory
GetModuleHandleA
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
CreateProcessW
lstrcatW
lstrcpynW
GetTempFileNameW
LockResource
CreateFileW
SizeofResource
LoadResource
FindResourceA
GetVersionExA
InterlockedCompareExchange
OpenFileMappingA
ReleaseMutex
CreateMutexA
CreateFileMappingA
InterlockedIncrement
UnmapViewOfFile
MapViewOfFile
lstrlenA
GetLastError
ExitProcess
HeapAlloc
MoveFileExW
HeapFree
WaitForSingleObject
GetProcessHeap
InitializeCriticalSection
Sleep
LeaveCriticalSection
GetModuleFileNameW
MultiByteToWideChar
EnterCriticalSection
CloseHandle
DeleteFileW
CreateThread
lstrcpyA
ReadProcessMemory
IsWow64Process
HeapReAlloc
SetEvent
ConnectNamedPipe
WriteFile
CreateEventA
ReadFile
GetOverlappedResult
DisconnectNamedPipe
CreateNamedPipeA
WaitForMultipleObjects
CreateRemoteThread
OpenProcess
VirtualFreeEx
VirtualAllocEx
GetStartupInfoA

advapi32

CryptAcquireContextA
CryptHashData
CryptDestroyHash
CryptCreateHash
OpenProcessToken
CryptReleaseContext
CryptGetHashParam
AdjustTokenPrivileges
LookupPrivilegeValueA

shell32

SHGetSpecialFolderPathW

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b9839d2cb3aab47690133d62188f5ef8

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

urlmon

wininet

msvcrt

kernel32

advapi32

shell32

Sections

.text Size: 15KB - Virtual size: 15KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 2KB - Virtual size: 212KB

.rsrc Size: 512B - Virtual size: 136B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 15KB - Virtual size: 15KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 2KB - Virtual size: 212KB

.rsrc
Size: 512B - Virtual size: 136B

.reloc
Size: 2KB - Virtual size: 2KB