49345cd56a348f674fa877ca0eae2e89_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

49345cd56a348f674fa877ca0eae2e89_JaffaCakes118
Size

529KB
MD5

49345cd56a348f674fa877ca0eae2e89
SHA1

29db6c92c08326b13d9d1067315f17cf3fb802fb
SHA256

e723b2b3b4e51be32897660c0450ac7789d032983059dc20e2ca2cc717eb4b30
SHA512

5963915ea1d532c2fff97ed168639b2f40d261ea4a75c5a7aeeb00b9122b8debe892168e04f806161298cabd68a01eb61f106f0dee26a29e0db5a45125880d51
SSDEEP

12288:xIlZYCjBMbvr892gxQvK6HSRR9mc5ehII:0K29kvcRu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49345cd56a348f674fa877ca0eae2e89_JaffaCakes118

Files

49345cd56a348f674fa877ca0eae2e89_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2794914636587f3d1a4ee178b2e747f2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

InitiateSystemShutdownA
GetSidIdentifierAuthority
LockServiceDatabase
IsValidSecurityDescriptor
QueryServiceConfigA
RegConnectRegistryW
MakeAbsoluteSD
AllocateAndInitializeSid

kernel32

ExitProcess
_lread
IsDBCSLeadByteEx
DuplicateHandle
RaiseException
CopyFileExW
GetOEMCP
GetDiskFreeSpaceExA
SetProcessAffinityMask
SetErrorMode
RemoveDirectoryA
FindFirstFileA
GetCurrentDirectoryW
GetFileAttributesA
GlobalDeleteAtom
GlobalFlags
FindResourceExA
QueryDosDeviceW
GlobalFindAtomW
InitializeCriticalSection
ReadConsoleA
GetCommModemStatus
lstrcmpA
GlobalReAlloc
ReadDirectoryChangesW
GlobalFindAtomA
EnumCalendarInfoW
CreateEventA
LocalFileTimeToFileTime
GetLocaleInfoW
GetPrivateProfileStringA
SetMailslotInfo
QueryDosDeviceA
VirtualQuery
GenerateConsoleCtrlEvent
WritePrivateProfileSectionW
IsBadStringPtrA
AllocConsole
SetEnvironmentVariableA
GetSystemTimeAsFileTime
FreeLibraryAndExitThread
CloseHandle
_lclose
WaitNamedPipeA
GlobalFree
DeleteCriticalSection
GlobalUnlock
EnumResourceNamesW
SetTimeZoneInformation
VirtualUnlock
_llseek
SetConsoleTitleA
GetFileType
GetACP
MoveFileW
EnumCalendarInfoA
EnumResourceLanguagesW
WriteProcessMemory
DeleteFiber

oleaut32

SafeArrayRedim
SysStringLen
VariantCopy
SysFreeString
VariantChangeType
SafeArrayPutElement
SafeArrayCreate
SetErrorInfo
SysAllocStringLen
LoadTypeLibEx

user32

DrawFocusRect
RegisterWindowMessageW
GetDoubleClickTime
GetMenuItemInfoW
OemToCharA
SendMessageA
SetClassLongA
LoadStringA
LoadCursorFromFileW
DefDlgProcW
SetClassLongW
GetWindowTextA
CopyImage
BeginDeferWindowPos
NotifyWinEvent
GetWindowLongW
WindowFromPoint
GetMessageA
MessageBoxA
DefDlgProcA
SetWindowPlacement
EnableMenuItem
GetWindowDC
MessageBoxW
DragDetect
DrawStateW
SetMenu
CreateDialogParamA

ole32

OleInitialize
CoTaskMemRealloc
PropVariantCopy
CoGetInterfaceAndReleaseStream
StgOpenStorage
CreateStreamOnHGlobal

Sections

.text
Size: 7KB - Virtual size: 223KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 263KB - Virtual size: 262KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2794914636587f3d1a4ee178b2e747f2

Headers

File Characteristics

Imports

advapi32

kernel32

oleaut32

user32

ole32

Sections

.text Size: 7KB - Virtual size: 223KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 263KB - Virtual size: 262KB

.rsrc Size: 16KB - Virtual size: 16KB

.text
Size: 7KB - Virtual size: 223KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 263KB - Virtual size: 262KB

.rsrc
Size: 16KB - Virtual size: 16KB