3d4492468b3e456476a934dd725e6e97_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3d4492468b3e456476a934dd725e6e97_JaffaCakes118
Size

175KB
MD5

3d4492468b3e456476a934dd725e6e97
SHA1

1ea24252a18c1598db208c8381ceb4f5bfa39ac6
SHA256

4863374bd476778356ddf0e05fa05aba0f26e299f3d47f7ae7e3e9f308a483b3
SHA512

def1449772a227deec768e8b114516f9defb48408b9027ad59a359149e077bdd9b2e27e2bd31bbb33aa281d5ce9e30b4a9de2b469ac15fac8fe28d002cbbdbb5
SSDEEP

3072:cxtOWlIwsRD/dLLYcljeA3bDuBzCCcQuk2E50La9mUQfomt7LXfU1OZ7TepapVod:Qb4RLLYcMASCqr5/9mUrmNjfU1OZnIa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3d4492468b3e456476a934dd725e6e97_JaffaCakes118

Files

3d4492468b3e456476a934dd725e6e97_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1b4782cad450682e21470424e9d22fd2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mprapi

MprConfigServerDisconnect
MprConfigServerConnect
MprConfigGetFriendlyName

shell32

SHGetFolderPathW

kernel32

GetSystemTimeAsFileTime
LeaveCriticalSection
SetEndOfFile
GetCurrentProcessId
GetCPInfo
VirtualFree
HeapDestroy
HeapFree
GetTickCount
HeapCreate
GetTimeZoneInformation
TerminateProcess
QueryPerformanceCounter
InitializeCriticalSection
RtlUnwind
HeapReAlloc
SetStdHandle
GetACP
HeapSize
GetOEMCP
GetConsoleOutputCP
EnumResourceTypesA
VirtualAlloc
CompareStringW
WriteFile
SetFilePointer
UnhandledExceptionFilter
GetLocaleInfoA
IsValidCodePage
IsDebuggerPresent
CreateMailslotW
RaiseException
SetEnvironmentVariableA
LCMapStringW
MultiByteToWideChar
SetUnhandledExceptionFilter
GetStringTypeW
LCMapStringA
LoadLibraryA
GetCurrentProcess
WriteConsoleA
FreeLibrary
ReadFile
GetTimeFormatA
CompareStringA
EnterCriticalSection
GetDateFormatA
GetStringTypeA

newdev

UpdateDriverForPlugAndPlayDevicesW

advapi32

LockServiceDatabase
QueryServiceStatus
GetInheritanceSourceW
UnlockServiceDatabase
RegQueryValueExW
LookupPrivilegeDisplayNameA
RegGetKeySecurity
InitializeAcl
SetSecurityDescriptorDacl
QueryServiceConfigW
IsValidAcl
OpenServiceW
DeleteService
GetAce
SetNamedSecurityInfoW
RegDeleteKeyW
IsValidSecurityDescriptor
GetSecurityDescriptorControl
LookupPrivilegeNameA
AllocateAndInitializeSid
RegCreateKeyExW
InitializeSecurityDescriptor
GetNamedSecurityInfoW
RegSetValueExW
LookupAccountSidW
EnumDependentServicesW
ControlService
GetSecurityInfo
SetEntriesInAclA
SetEntriesInAclW
GetAclInformation
RegOpenKeyExW
ChangeServiceConfigW
GetTokenInformation
FreeInheritedFromArray
RegCloseKey
OpenSCManagerW
SetSecurityInfo
OpenProcessToken
CreateServiceW
LookupPrivilegeValueA
CloseServiceHandle
RegRestoreKeyW
AdjustTokenPrivileges
AddAce
RegDeleteValueW
StartServiceA
EqualSid
RegSaveKeyW
ChangeServiceConfig2W
FreeSid
RegEnumKeyExW
QueryServiceLockStatusW
RegEnumValueW

oleacc

LresultFromObject
AccessibleObjectFromPoint

Sections

.text
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1b4782cad450682e21470424e9d22fd2

Headers

File Characteristics

Imports

mprapi

shell32

kernel32

newdev

advapi32

oleacc

Sections

.text Size: 42KB - Virtual size: 41KB

.rdata Size: 3KB - Virtual size: 155KB

.data Size: 128KB - Virtual size: 128KB

.rsrc Size: 512B - Virtual size: 4KB

.text
Size: 42KB - Virtual size: 41KB

.rdata
Size: 3KB - Virtual size: 155KB

.data
Size: 128KB - Virtual size: 128KB

.rsrc
Size: 512B - Virtual size: 4KB