43203d68a131dd25b8ae193c782e161c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

43203d68a131dd25b8ae193c782e161c_JaffaCakes118
Size

1.2MB
MD5

43203d68a131dd25b8ae193c782e161c
SHA1

7b85d7d8622cf4c9829f68d96a5b3f5e4cbc2fb8
SHA256

147b7ed75ce5db4b081ff6165904c76a5ce8b6765e53c72116d60386e46ccfba
SHA512

3fb298b008750aedc40bec09c6918a0a27256edc27803c91e861b86f58aafe3dcd02ae2842cfd47b7e64d2e104114d78210ec0d9005bbe73b15fb164c2cee308
SSDEEP

12288:3etnTUe4UXkA4QHRnh+W2F45MB3kf0hCbh/L0uNQatW5QRXhIA:Or5mmOW2F45Mqf08l/wRaCQRXh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
43203d68a131dd25b8ae193c782e161c_JaffaCakes118

Files

43203d68a131dd25b8ae193c782e161c_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b714e698fb14d25b4d46d52f38d9a158

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ExitProcess
CreateFileA
MoveFileWithProgressA
FillConsoleOutputCharacterA
ReadConsoleInputA
EnumCalendarInfoExA
HeapFree
GetProcessHeap
HeapAlloc
ExitThread
Beep

user32

LoadStringW
ExitWindowsEx
MessageBeep
GetSystemMetrics
BroadcastSystemMessageA
GetCursorPos
GetMessageTime

advapi32

RegDeleteValueW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextW
OpenProcessToken
GetTokenInformation
RegSetValueExW
AllocateAndInitializeSid
LookupAccountSidW
FreeSid
OpenThreadToken
SetThreadToken
RevertToSelf
RegQueryInfoKeyW
RegQueryValueExW
RegNotifyChangeKeyValue
RegOpenKeyExW
CloseServiceHandle
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
RegOpenKeyW
RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
CryptSetProvParam
CryptGetProvParam
CryptReleaseContext
RegConnectRegistryW

rpcrt4

RpcImpersonateClient
RpcServerInqDefaultPrincNameW
RpcServerRegisterAuthInfoW
RpcServerRegisterIfEx
RpcBindingToStringBindingW
RpcServerListen
RpcStringFreeW
I_RpcBindingIsClientLocal
RpcStringBindingParseW
RpcServerRegisterIf
NdrServerCall2
RpcRaiseException
I_RpcBindingInqLocalClientPID
RpcServerUseProtseqEpW
RpcRevertToSelf

Exports

Exports

yoyhedsdz

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b714e698fb14d25b4d46d52f38d9a158

Headers

File Characteristics

Imports

kernel32

user32

advapi32

rpcrt4

Exports

Exports

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 1.2MB - Virtual size: 1.2MB

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1.2MB - Virtual size: 1.2MB

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 2KB - Virtual size: 2KB