44fed0508ac717165fdab6cb07265560_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

44fed0508ac717165fdab6cb07265560_JaffaCakes118
Size

76KB
MD5

44fed0508ac717165fdab6cb07265560
SHA1

46fe72187ec46e078efa04f7c452fcfb96feaf2f
SHA256

857f43039071b6307e4e8a433799eb87cfec41ac7ffd60f21348ba2dc8d3020f
SHA512

1aff64f15d2518500db7223b29be1d09b33d30d1eccd2ec096d4dc80328e0f4ff82607b1c7a90343aafe6eb87c99d690c10b5245ff9f1738481d26f2c3df7858
SSDEEP

1536:q12mHmyjjjdHDv7Au6Ad7UhHnbUfB9Ppw5ZMCs9F4:e2m5j9HDsX4Uh7U652CUF4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44fed0508ac717165fdab6cb07265560_JaffaCakes118

Files

44fed0508ac717165fdab6cb07265560_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6bbb682434806740aacc493f436ac756

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

ZwOpenThread
RtlImageNtHeader
ZwQuerySystemInformation
RtlAdjustPrivilege
ZwImpersonateThread
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
ZwLoadDriver
_snwprintf
strncat
RtlRandom
LdrAddRefDll
ZwMakeTemporaryObject
sscanf
strncpy
strchr
ZwClose
_snprintf
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
RtlEqualUnicodeString
memset
memcpy

shlwapi

SHDeleteKeyA
PathFindFileNameA
PathFileExistsW

imagehlp

CheckSumMappedFile

psapi

GetMappedFileNameW

wininet

InternetConnectA
HttpOpenRequestA
InternetOpenA
HttpSendRequestA
InternetQueryOptionA
InternetSetOptionA
InternetCloseHandle
InternetCrackUrlA

kernel32

DeleteFileW
Sleep
UnmapViewOfFile
GetFileSize
MapViewOfFile
CreateFileMappingA
CreateFileW
CopyFileW
GetModuleHandleW
ExitProcess
GetCurrentProcess
GetModuleHandleA
GetProcAddress
DeleteFileA
GetSystemTime
WritePrivateProfileStringA
GetTickCount
WriteFile
CreateFileA
GetTempFileNameA
GetTempPathA
VirtualFree
CreateThread
CloseHandle
GetLastError
GetVersionExA
MoveFileExW
GetTempPathW
GetModuleFileNameW
VirtualAlloc
GetTempFileNameW

winspool.drv

AddPrintProvidorW
DeletePrintProvidorW

advapi32

CloseServiceHandle
QueryServiceStatusEx
StartServiceA
OpenSCManagerA
OpenServiceA
RegCloseKey
RegSetValueExA
RegCreateKeyA

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tdl
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 644B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6bbb682434806740aacc493f436ac756

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

shlwapi

imagehlp

psapi

wininet

kernel32

winspool.drv

advapi32

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: - Virtual size: 4KB

.tdl Size: 64KB - Virtual size: 64KB

.rsrc Size: 512B - Virtual size: 448B

.reloc Size: 1024B - Virtual size: 644B

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: - Virtual size: 4KB

.tdl
Size: 64KB - Virtual size: 64KB

.rsrc
Size: 512B - Virtual size: 448B

.reloc
Size: 1024B - Virtual size: 644B