43ee1f3f6c09f66c347cb49a85a6fe89_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

43ee1f3f6c09f66c347cb49a85a6fe89_JaffaCakes118
Size

788KB
MD5

43ee1f3f6c09f66c347cb49a85a6fe89
SHA1

488f638c9628fb853606c911adfb926bbbfb6e30
SHA256

a05cf213cd83ec744d18a8ff615060302fad05c96165940822c497392ab1d98a
SHA512

029e18964be28d0a1ba1a46bb6ce2be8f8fd0661c7c301f8f2108be04c835a2bd79d9ed7a5ab2baaf7f27b4a45ff1a9eda9081ba64c802639859c976f3e1f422
SSDEEP

12288:c4GtUUq6xWPV5u0TZFDm6tbHU8QYB8/SGDiThV9tnCeUs/cVGB8JDIpQodX0iN5+:8t4pVrVFLtbHdQYB8KGeThV9ZLX0idN6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
43ee1f3f6c09f66c347cb49a85a6fe89_JaffaCakes118

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

Files

43ee1f3f6c09f66c347cb49a85a6fe89_JaffaCakes118
.exe windows:5 windows x86 arch:x86

da83547bda38c29ba1fba52621aec4c9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindNextFileA
OutputDebugStringW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetCurrentProcess
OpenProcess
TerminateProcess
CreateEventW
Sleep
ResetEvent
lstrcmpiA
CreateDirectoryW
CopyFileW
CreateProcessW
GetExitCodeProcess
CreateFileW
DeleteFileW
WriteFile
FreeResource
LocalFree
CreateFileA
FindFirstFileA
lstrcmpiW
GetModuleFileNameW
WaitForSingleObject
SetEvent
CloseHandle
lstrlenA
FindResourceExW
FindResourceW
SizeofResource
LockResource
LoadResource
lstrlenW
WideCharToMultiByte
GetFileAttributesW
MultiByteToWideChar
SetEndOfFile
GetModuleHandleA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LoadLibraryA
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RaiseException
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetLastError
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeW
HeapCreate
VirtualFree
VirtualAlloc
GetStringTypeA
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
ExitProcess
GetModuleFileNameA
GetConsoleCP
GetConsoleMode
SetFilePointer
ReadFile
FlushFileBuffers
GetACP
GetOEMCP
IsValidCodePage

advapi32

GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSecurityDescriptorToSecurityDescriptorA
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegDeleteValueA
RegOpenKeyA
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegFlushKey
RegCloseKey
SetSecurityInfo

shell32

SHFileOperationA
SHGetSpecialFolderPathA
SHGetFolderPathW
ShellExecuteA
SHGetSpecialFolderPathW

ole32

CoUninitialize
CoCreateInstance
CoInitialize

shlwapi

SHDeleteKeyA
PathRemoveFileSpecW
PathAddBackslashA
PathAddBackslashW

psapi

GetModuleFileNameExW

wininet

InternetCloseHandle
InternetReadFile
InternetOpenW
InternetConnectA
HttpOpenRequestA
HttpSendRequestW
InternetOpenUrlW

ws2_32

WSAStartup
WSACleanup

Sections

.text
Size: 149KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 987KB - Virtual size: 986KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

da83547bda38c29ba1fba52621aec4c9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

ole32

shlwapi

psapi

wininet

ws2_32

Sections

.text Size: 149KB - Virtual size: 148KB

.rdata Size: 30KB - Virtual size: 30KB

.data Size: 7KB - Virtual size: 15KB

.rsrc Size: 987KB - Virtual size: 986KB

.text
Size: 149KB - Virtual size: 148KB

.rdata
Size: 30KB - Virtual size: 30KB

.data
Size: 7KB - Virtual size: 15KB

.rsrc
Size: 987KB - Virtual size: 986KB