3bde3c8ecec1d26c5bc715eb5fcbfb0f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3bde3c8ecec1d26c5bc715eb5fcbfb0f_JaffaCakes118
Size

160KB
MD5

3bde3c8ecec1d26c5bc715eb5fcbfb0f
SHA1

272e769c8ac69198d1e78dfe547da66fe58f9415
SHA256

48382bf74d318cce3b373362c347b794a3518cf04ed0e9ec7169775f34b14b76
SHA512

e6248032a17d36aa1cc4d227f2fb25839cf5a83df6fd2e4a00ba2fc1f0bfe553d50e8e65ab78feb753e30bd6d24f2fd8691a56f335357a933d3b8d20b8a4f375
SSDEEP

3072:Lsdbl0z1MXooX8DXRX8+HkPH0SRffOl6bDoNo79ZXKyGhAtc2oxRk7W2iLrnRMg:Lsv0z1MXooX8DXRX8+6/nty2XZsAOvzj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3bde3c8ecec1d26c5bc715eb5fcbfb0f_JaffaCakes118

Files

3bde3c8ecec1d26c5bc715eb5fcbfb0f_JaffaCakes118
.exe windows:1 windows x86 arch:x86

304708859ac22b1c0621d98440893abe

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteW

kernel32

SetThreadContext
DeleteFileW
CreateMailslotW
EnterCriticalSection
FindNextFileA
FindClose
GetCurrencyFormatA
VirtualAlloc
GetSystemDirectoryW
VirtualFree
GetModuleFileNameA
lstrlenA
GetThreadTimes
GetSystemDefaultLCID
InitializeCriticalSection
LeaveCriticalSection
WriteFile
GetModuleHandleA
GetEnvironmentVariableA
GetLastError
VerSetConditionMask
GlobalUnfix
Sleep
DuplicateHandle
ReadFile
CreateNamedPipeA
lstrcatA
CopyFileA
CreateFileA
GetSystemDirectoryA
OpenProcess
GlobalLock
GetTickCount
GetLocaleInfoA
FindFirstFileA
lstrcpyW
SetErrorMode
FindVolumeMountPointClose
Process32NextW
GetProcAddress
BaseProcessInitPostImport
ReadDirectoryChangesW
GetCurrentProcess
DosPathToSessionPathW
GetFileSizeEx
InterlockedPushEntrySList
CreateSemaphoreA
WriteProfileSectionA
lstrcpyA
DeleteFileA
GetWindowsDirectoryA
CloseHandle
SetComputerNameA
CreateFileW
lstrcatW

advapi32

AdjustTokenPrivileges
OpenSCManagerA
RegCloseKey
RegQueryValueExA
RegCreateKeyA
LookupPrivilegeValueA
LsaGetQuotasForAccount
CryptGenKey
GetNumberOfEventLogRecords
RegOpenKeyA
OpenProcessToken
ConvertSecurityDescriptorToAccessW
EnumServicesStatusA
CloseServiceHandle
WmiSetSingleInstanceA
RegSetValueExA

ntdll

vsprintf
memset
RtlFreeUnicodeString
NtQuerySystemInformation
RtlInitAnsiString
isdigit
NtQueryObject
isspace
sprintf
tolower
_chkstk
strlen
RtlAnsiStringToUnicodeString
strstr
ZwLoadDriver
strncmp
memcpy
wcsstr

psapi

EnumProcesses
GetProcessImageFileNameA

ws2_32

select
connect
htons
__WSAFDIsSet
WSARemoveServiceClass
gethostbyname
WSARecvFrom
send
WSAStartup
htonl
WSAEnumNetworkEvents
recv
gethostbyaddr
closesocket
WSAEnumNameSpaceProvidersA
socket

ole32

CoCreateGuid

user32

PrivateExtractIconsA
ExitWindowsEx
CharLowerW

Sections

.data
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 512B - Virtual size: 391B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

304708859ac22b1c0621d98440893abe

Headers

File Characteristics

Imports

shell32

kernel32

advapi32

ntdll

psapi

ws2_32

ole32

user32

Sections

.data Size: 21KB - Virtual size: 20KB

.text Size: 512B - Virtual size: 391B

.idata Size: 3KB - Virtual size: 3KB

.data
Size: 21KB - Virtual size: 20KB

.text
Size: 512B - Virtual size: 391B

.idata
Size: 3KB - Virtual size: 3KB