4d68bfdb4f1790a0a5890bf23b3ce5c2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4d68bfdb4f1790a0a5890bf23b3ce5c2_JaffaCakes118
Size

306KB
MD5

4d68bfdb4f1790a0a5890bf23b3ce5c2
SHA1

c4a498e9c441e102fb343e51536e1da02e01ddc2
SHA256

abe1bb3013cbe14594384b4b68dc5ba21b65e4b4756082adf5835f6e74c60610
SHA512

87f08ddd531d55ae83b7939133632d787cb53fed36268ba5b4c401df63e66db1b86a5e83b0ab97ed8b1ac850bfde9fd32743d7ff4f832b855f7e418f1ae5cdb5
SSDEEP

6144:NkOMD9hpIR8QDCKNNo7TgYY0m5tUrBvj5LwMQow7E:eOMh01NP+NMl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d68bfdb4f1790a0a5890bf23b3ce5c2_JaffaCakes118

Files

4d68bfdb4f1790a0a5890bf23b3ce5c2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f5f509f045f134a036f425d81c439f50

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

EnumPropsExA
GetClassInfoExA
CallNextHookEx
AppendMenuW
MsgWaitForMultipleObjectsEx
GetScrollRange
MapVirtualKeyExW
GetCursorPos
GetSystemMenu
GetDC
GetWindowLongW
OemKeyScan
DialogBoxIndirectParamA
GetMenuState
GetClassInfoW
GetSystemMetrics
CreateCursor

mfcsubs

?RemoveAll@CMapStringToPtr@@QAEXXZ
?SetAtGrow@CStringArray@@QAEXHPBG@Z
??1CString@@QAE@XZ
??1CMapStringToPtr@@UAE@XZ
??YCString@@QAEABV0@PBG@Z
?Lookup@CMapStringToPtr@@QBEHPBGAAPAX@Z
?ReverseFind@CString@@QBEHG@Z
??H@YG?AVCString@@ABV0@0@Z
??0CStringArray@@QAE@XZ
?GetBuffer@CString@@QAEPAGH@Z
?Right@CString@@QBE?AV1@H@Z
?Mid@CString@@QBE?AV1@H@Z
??1CStringArray@@UAE@XZ
??H@YG?AVCString@@ABV0@PBG@Z
??0CString@@QAE@XZ

msvcrt

exit
_ultoa
rewind
vfprintf
_wstrdate
__p__osver
_spawnvp
__p__iob
rand
_access

winsta

WinStationCloseServer
WinStationGetAllProcesses
WinStationFreeGAPMemory
WinStationTerminateProcess
WinStationQueryInformationW
WinStationFreeMemory
WinStationDisconnect
WinStationEnumerateA
WinStationSendMessageW
WinStationGetTermSrvCountersValue
WinStationWaitSystemEvent
WinStationReset
WinStationOpenServerW
WinStationEnumerateProcesses
WinStationEnumerateW

kernel32

GetCommandLineW
GetStringTypeExA
ExitProcess
WritePrivateProfileStructW
GetCurrentProcessId
GetLogicalDrives
GetEnvironmentStringsA
RtlZeroMemory
GetACP
GetTickCount
GetUserDefaultLCID
Sleep
TlsAlloc
GetLastError
GetModuleHandleW
PeekConsoleInputW
CancelWaitableTimer
GetCurrentThread
DeleteCriticalSection
GetModuleHandleA
GetVersion
GetCurrentProcess
DeleteTimerQueueEx
GetCommandLineA
_lcreat
GetShortPathNameW
GetProcessHeap
OpenFile
GetCurrentThreadId
VirtualAlloc
PeekNamedPipe
GetEnvironmentVariableA
EnumResourceTypesA

scecli

SceCommitTransaction
SceSvcConvertTextToSD
SceCreateDirectory
SceGetSecurityProfileInfo
SceEnumerateServices
SceSvcSetInformationTemplate
SceUpdateObjectInfo
SceSvcQueryInfo
SceLookupPrivRightName
SceGetScpProfileDescription

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.CRT
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 106KB - Virtual size: 206KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 170KB - Virtual size: 270KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f5f509f045f134a036f425d81c439f50

Headers

DLL Characteristics

File Characteristics

Imports

user32

mfcsubs

msvcrt

winsta

kernel32

scecli

Sections

.text Size: 8KB - Virtual size: 7KB

.CRT Size: 512B - Virtual size: 24KB

.rdata Size: 106KB - Virtual size: 206KB

DATA Size: 170KB - Virtual size: 270KB

.rsrc Size: 20KB - Virtual size: 19KB

.text
Size: 8KB - Virtual size: 7KB

.CRT
Size: 512B - Virtual size: 24KB

.rdata
Size: 106KB - Virtual size: 206KB

DATA
Size: 170KB - Virtual size: 270KB

.rsrc
Size: 20KB - Virtual size: 19KB