44919a014f66f57a73476e5fc07e7922_JaffaCakes118

General

Target

44919a014f66f57a73476e5fc07e7922_JaffaCakes118
Size

717KB
MD5

44919a014f66f57a73476e5fc07e7922
SHA1

2ff753bbc13365531c485e8744ebc365532fb54f
SHA256

aedea249eb10527b5617a41117dd6600c1968df14981250e61f6e7d9841866ea
SHA512

ab2885b56d42721fece1bc65ce9636263bcbe77e8bd99ec91f13604ddf4126c279cc399f9479416557cf3bdd82aa3239aedbc698fd0abbd8d24643f1ee145817
SSDEEP

12288:hVJlsUqINh4VQxYGV87YnomkZeKAPkP/f9NArbfr9dt2n4b76WadHKH0jI+FtlWG:fTsUPhrxYGVJnoVQdkP/VNufx24bwEf0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44919a014f66f57a73476e5fc07e7922_JaffaCakes118

Files

44919a014f66f57a73476e5fc07e7922_JaffaCakes118
.exe windows:4 windows x86 arch:x86

696b2ec80c3b8b0a9d40613ed61354e4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegDeleteValueA
RegEnumKeyExA
RegSetValueExA
CryptDestroyHash
CryptCreateHash
RegCloseKey
CryptGetHashParam
RegQueryValueExA
DuplicateTokenEx
RegCreateKeyExA

kernel32

GetModuleHandleA
GetFileAttributesA
VirtualAlloc
GetFileAttributesW
GetSystemTime
CreateProcessW
ExpandEnvironmentStringsW
GetFileTime
SetFileTime
lstrcmpiA
GetSystemTimeAsFileTime
lstrcatW
GetTimeZoneInformation
ResetEvent
GetCommandLineA
EnterCriticalSection
OpenMutexW
VirtualProtect
SystemTimeToFileTime
SetFilePointer

shlwapi

wvnsprintfW
PathRemoveFileSpecW
SHDeleteKeyA
wnsprintfA
PathFindFileNameW
StrCmpNIW
PathMatchSpecW
StrCmpNIA
wnsprintfW
StrStrW
wvnsprintfA
PathCombineW
PathFileExistsW

user32

OpenWindowStationA
CharLowerBuffA
SendMessageA
GetDlgItem
MsgWaitForMultipleObjects
SetThreadDesktop
CloseDesktop
LoadCursorA
EndDialog
GetKeyState
GetClassNameA
SetProcessWindowStation

Sections

.text
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Uivsph
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.VCrypt
Size: 91B - Virtual size: 91B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

696b2ec80c3b8b0a9d40613ed61354e4

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

shlwapi

user32

Sections

.text Size: 59KB - Virtual size: 58KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 20KB

.Uivsph Size: 512B - Virtual size: 4KB

.VCrypt Size: 91B - Virtual size: 91B

.text
Size: 59KB - Virtual size: 58KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 20KB

.Uivsph
Size: 512B - Virtual size: 4KB

.VCrypt
Size: 91B - Virtual size: 91B