4b72abe1294ac0f7725715b4cdbb8439_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4b72abe1294ac0f7725715b4cdbb8439_JaffaCakes118
Size

317KB
MD5

4b72abe1294ac0f7725715b4cdbb8439
SHA1

7ddaec8e0dbec864fa275cdbf4720ec98fbd53ab
SHA256

d7a08b54b8e976874be995771424fda3a3f0ba5a583a7f0e35b7b95f8b97fc71
SHA512

463a3ed424d33054ed736ca7aa9afc5d5c64282dcf02ebe9935d67c6e293eb311e407cca8a176d3005d602aab3f4d64b61811317696ae83897c5d53d9badd5d8
SSDEEP

6144:VMQll1nS9MupwX8NOu7Bd+eTFSeYLuOyPKC:x+wF+fFSeud

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4b72abe1294ac0f7725715b4cdbb8439_JaffaCakes118

Files

4b72abe1294ac0f7725715b4cdbb8439_JaffaCakes118
.exe windows:5 windows x86 arch:x86

bf31194bb124c5f7440d4025a3455686

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize

advapi32

OpenSCManagerA
ChangeServiceConfigA
RegOpenKeyA
RegQueryValueExW
OpenServiceA
QueryServiceStatus
CloseServiceHandle
RegSetValueExA
RegCloseKey
StartServiceA
RegOpenKeyW
RegEnumKeyA
RegOpenKeyExA
RegQueryValueExA

ntdll

NtAllocateVirtualMemory
RtlUshortByteSwap
LdrGetDllHandle

kernel32

MultiByteToWideChar
GetLocaleInfoA
VirtualFree
GlobalAlloc
CreateDirectoryW
FormatMessageA
lstrcmpiW
VirtualProtect
GetShortPathNameW
LoadLibraryA
ExitProcess
GetVersionExA
GetProcessHeap
LCMapStringA
GetTempPathW
GetStringTypeW
GetSystemInfo
GetModuleHandleA
LCMapStringW
HeapReAlloc
CreateFileA
WriteFile
HeapAlloc
GetProcAddress
GlobalFree
WideCharToMultiByte
lstrcmpA
CloseHandle
GetCPInfo
lstrcmpiA
Sleep
lstrlenA
FreeLibrary
LoadLibraryW
GetTempFileNameW
DeleteFileW
GetTickCount
GetLastError
VirtualAlloc
lstrcpyA
GetStringTypeA
HeapFree

user32

wsprintfA

setupapi

SetupDiGetDeviceInstanceIdW
SetupDiDestroyDeviceInfoList
SetupDiOpenDevRegKey
SetupDiEnumDeviceInfo
SetupDiCreateDeviceInfoList
SetupDiCallClassInstaller
SetupDiSetClassInstallParamsA
SetupOpenMasterInf
SetupCloseInfFile
SetupDiGetClassDevsW
SetupPromptForDiskA
SetupGetSourceInfoA
SetupGetSourceFileLocationA

tapi32

lineInitializeExW
lineGetID
lineNegotiateAPIVersion
lineOpen
lineGetDevCapsW
lineClose
lineShutdown

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 287KB - Virtual size: 286KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bf31194bb124c5f7440d4025a3455686

Headers

DLL Characteristics

File Characteristics

Imports

ole32

advapi32

ntdll

kernel32

user32

setupapi

tapi32

Sections

.text Size: 15KB - Virtual size: 15KB

.rsrc Size: 287KB - Virtual size: 286KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 3KB - Virtual size: 1.4MB

.tls Size: 512B - Virtual size: 4KB

.text
Size: 15KB - Virtual size: 15KB

.rsrc
Size: 287KB - Virtual size: 286KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 3KB - Virtual size: 1.4MB

.tls
Size: 512B - Virtual size: 4KB