42804b69e33703f612becb03643d8d4b_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

42804b69e33703f612becb03643d8d4b_JaffaCakes118
Size

71KB
MD5

42804b69e33703f612becb03643d8d4b
SHA1

eccd49f68ddb5f47be3c308711b922ed1400f413
SHA256

107156de6a0c794fdde01266b76a4e381c2d299ffa0991d61941bef9d4e8ad24
SHA512

71b1f1e0afc2bd37279a328ce59c8bfe867e26001d968d70d290032edca12060c15ef7d57b94720b1a2a7b331901c31c98bffd9ac729a79dba893bea08c8e3b5
SSDEEP

1536:ig54jOJx3sIIs7iYOMkdErZVF1lVF1lVF1lU1disKldRyAI+yw4ENiRSqDRRCq:7OO7iYWUVwy4EsRjtU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42804b69e33703f612becb03643d8d4b_JaffaCakes118

Files

42804b69e33703f612becb03643d8d4b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

40c96a39f763b40d9d84e763f8a712b7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

towupper
fprintf
__p__iob
exit
_exit
_XcptFilter
__p___winitenv
wcscmp
_initterm
__wgetmainargs
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_except_handler3

advapi32

LsaFreeMemory
GetUserNameA
RegQueryValueExW
LsaOpenPolicy
LsaQueryInformationPolicy
RegSetValueExW
LsaClose
RegOpenKeyExW
RegQueryInfoKeyA
RegDeleteKeyW
RegCreateKeyExA
RegCloseKey

kernel32

MoveFileW
GetTickCount
GetCurrentThreadId
ExitProcess
CloseHandle
FormatMessageW
GetLocalTime
QueryPerformanceCounter
GlobalMemoryStatus
GetDiskFreeSpaceW
GetComputerNameA
CreateFileW
DeleteFileW
GetLastError
SetErrorMode
ReadFile
GetModuleHandleW
GetCurrentProcessId
WriteFile
CreateFileA

user32

EnableWindow
SetFocus
SetDlgItemTextW
GetDlgItemTextW
IsDlgButtonChecked
EndDialog
wsprintfW
GetDlgItem
SendMessageW
SetCursor
DialogBoxParamW
CheckDlgButton
GetMessageTime
GetCursorPos
LoadCursorW
LoadStringW
MessageBoxW
GetWindowLongW
SetWindowLongW
LoadImageW

samlib

SamiGetBootKeyInformation
SamConnect
SamOpenDomain
SamiSetBootKeyInformation
SamCloseHandle

ntdll

RtlLengthSid
RtlInitUnicodeString
RtlNtStatusToDosError

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 788B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

eciumaa
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

40c96a39f763b40d9d84e763f8a712b7

Headers

File Characteristics

Imports

msvcrt

advapi32

kernel32

user32

samlib

ntdll

Sections

.text Size: 13KB - Virtual size: 12KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 788B

.rsrc Size: 15KB - Virtual size: 15KB

.reloc Size: 34KB - Virtual size: 35KB

eciumaa Size: - Virtual size: 4KB

.text
Size: 13KB - Virtual size: 12KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 788B

.rsrc
Size: 15KB - Virtual size: 15KB

.reloc
Size: 34KB - Virtual size: 35KB

eciumaa
Size: - Virtual size: 4KB