4651293151b687c631b8bccbb5d40f47_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4651293151b687c631b8bccbb5d40f47_JaffaCakes118
Size

146KB
MD5

4651293151b687c631b8bccbb5d40f47
SHA1

b1edd43fad3cf615767551ac0914f831af3959b9
SHA256

0a6be3a86e65a5b9ac8607c83a4084f35f1fabd74eae520a9f9e0bfb713b705a
SHA512

4e244c82edf094b991995be6d69b26974fb857a8012d24c37ec91f26b86d40645966f186ba527574846fb9065ce58794e763869af943e80e873ff0c69683428e
SSDEEP

3072:v6UyITB8ZGws/s7ENBoqpWWCU3yM6/x9vB9q9sAc+TV3UHGag5VOW:ynIlqLs/sIqqpWWCU3l6P+9tb+HGag2W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4651293151b687c631b8bccbb5d40f47_JaffaCakes118

Files

4651293151b687c631b8bccbb5d40f47_JaffaCakes118
.exe windows:5 windows x86 arch:x86

0052057d7d1416d78b7088779a2bb424

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemTime
GetCurrentProcessId
EnterCriticalSection
WaitCommEvent
FindClose
DeleteFileA
GetFileAttributesA
CreateFileA
TerminateProcess
CreateProcessA
VirtualQuery
GetVersion
WriteFile
OpenEventA
CreateEventA
ExitProcess
HeapAlloc
SetUnhandledExceptionFilter
CreateThread
DosDateTimeToFileTime
ReadFile
GetCurrentThreadId
LeaveCriticalSection
SetFileAttributesA
SystemTimeToFileTime
HeapFree
LocalFileTimeToFileTime
GetDiskFreeSpaceA
SetLastError
GetProcessHeap
GetDriveTypeA
GetFileSize
MoveFileExA
FindNextFileA
GetSystemDirectoryA
MoveFileA
SetEndOfFile
GetProcAddress
GetExitCodeProcess
DeviceIoControl
GetSystemTimeAsFileTime
SetFileTime
FreeLibrary
QueryDosDeviceA
ExpandEnvironmentStringsA
FindFirstFileA
WideCharToMultiByte
SetErrorMode
lstrcpynA
SetThreadAffinityMask
CloseHandle
GetTickCount
GetCommandLineA
CopyFileA
QueryPerformanceCounter
DeleteCriticalSection
SetFilePointer
SetEvent
Sleep
GetVersionExA
GetModuleHandleA
GetCurrentDirectoryA
SetHandleContext
BackupWrite
RemoveDirectoryA

advapi32

OpenProcessToken
InitiateSystemShutdownA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
CryptGenRandom
CryptAcquireContextA
GetLengthSid
AddAccessAllowedAce
AllocateAndInitializeSid
GetTokenInformation
CryptReleaseContext

user32

SendDlgItemMessageA
SendMessageA
SetParent
LoadStringA
MessageBoxA
DialogBoxParamA
EndDialog
ShowWindow

ntdll

NtShutdownSystem
NtClose
NtOpenProcessToken
NtAdjustPrivilegesToken

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.kltxed
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 133KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0052057d7d1416d78b7088779a2bb424

Headers

File Characteristics

Imports

kernel32

advapi32

user32

ntdll

shell32

Sections

.text Size: 6KB - Virtual size: 5KB

.data Size: 8KB - Virtual size: 14KB

.kltxed Size: 3KB - Virtual size: 3KB

.edata Size: 133KB - Virtual size: 155KB

.text
Size: 6KB - Virtual size: 5KB

.data
Size: 8KB - Virtual size: 14KB

.kltxed
Size: 3KB - Virtual size: 3KB

.edata
Size: 133KB - Virtual size: 155KB