41ab202a0f2679cd38b468b8be00f635_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

41ab202a0f2679cd38b468b8be00f635_JaffaCakes118
Size

660KB
MD5

41ab202a0f2679cd38b468b8be00f635
SHA1

79caac818b9ded36f75305e96ec72ae5a12b21c3
SHA256

b5959891e25f9427dc548a5b6404938587b34bb03c00b885c9b8e1191ee0c58a
SHA512

5b109cfee86fb23027b9069eaa161446c7164c72f591a245b829c5ee12796e3f4cf13208f42301541775039239b94025d033a50730fab64469d2a9225f4c08d9
SSDEEP

12288:xIlZYCjBMbvr892gxQVG2wJ+OMSAZwIzqg1a9J6DUcmlOBn/VcrK:0K29kqh3Wzqg186Qc2Kn/GrK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41ab202a0f2679cd38b468b8be00f635_JaffaCakes118

Files

41ab202a0f2679cd38b468b8be00f635_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2794914636587f3d1a4ee178b2e747f2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

InitiateSystemShutdownA
GetSidIdentifierAuthority
LockServiceDatabase
IsValidSecurityDescriptor
QueryServiceConfigA
RegConnectRegistryW
MakeAbsoluteSD
AllocateAndInitializeSid

kernel32

ExitProcess
_lread
IsDBCSLeadByteEx
DuplicateHandle
RaiseException
CopyFileExW
GetOEMCP
GetDiskFreeSpaceExA
SetProcessAffinityMask
SetErrorMode
RemoveDirectoryA
FindFirstFileA
GetCurrentDirectoryW
GetFileAttributesA
GlobalDeleteAtom
GlobalFlags
FindResourceExA
QueryDosDeviceW
GlobalFindAtomW
InitializeCriticalSection
ReadConsoleA
GetCommModemStatus
lstrcmpA
GlobalReAlloc
ReadDirectoryChangesW
GlobalFindAtomA
EnumCalendarInfoW
CreateEventA
LocalFileTimeToFileTime
GetLocaleInfoW
GetPrivateProfileStringA
SetMailslotInfo
QueryDosDeviceA
VirtualQuery
GenerateConsoleCtrlEvent
WritePrivateProfileSectionW
IsBadStringPtrA
AllocConsole
SetEnvironmentVariableA
GetSystemTimeAsFileTime
FreeLibraryAndExitThread
CloseHandle
_lclose
WaitNamedPipeA
GlobalFree
DeleteCriticalSection
GlobalUnlock
EnumResourceNamesW
SetTimeZoneInformation
VirtualUnlock
_llseek
SetConsoleTitleA
GetFileType
GetACP
MoveFileW
EnumCalendarInfoA
EnumResourceLanguagesW
WriteProcessMemory
DeleteFiber

oleaut32

SafeArrayRedim
SysStringLen
VariantCopy
SysFreeString
VariantChangeType
SafeArrayPutElement
SafeArrayCreate
SetErrorInfo
SysAllocStringLen
LoadTypeLibEx

user32

DrawFocusRect
RegisterWindowMessageW
GetDoubleClickTime
GetMenuItemInfoW
OemToCharA
SendMessageA
SetClassLongA
LoadStringA
LoadCursorFromFileW
DefDlgProcW
SetClassLongW
GetWindowTextA
CopyImage
BeginDeferWindowPos
NotifyWinEvent
GetWindowLongW
WindowFromPoint
GetMessageA
MessageBoxA
DefDlgProcA
SetWindowPlacement
EnableMenuItem
GetWindowDC
MessageBoxW
DragDetect
DrawStateW
SetMenu
CreateDialogParamA

ole32

OleInitialize
CoTaskMemRealloc
PropVariantCopy
CoGetInterfaceAndReleaseStream
StgOpenStorage
CreateStreamOnHGlobal

Sections

.text
Size: 7KB - Virtual size: 223KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 263KB - Virtual size: 262KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2794914636587f3d1a4ee178b2e747f2

Headers

File Characteristics

Imports

advapi32

kernel32

oleaut32

user32

ole32

Sections

.text Size: 7KB - Virtual size: 223KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 263KB - Virtual size: 262KB

.rsrc Size: 16KB - Virtual size: 16KB

.text
Size: 7KB - Virtual size: 223KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 263KB - Virtual size: 262KB

.rsrc
Size: 16KB - Virtual size: 16KB