4dc6ab87e9cb5f7a2dc88ff1cadb105b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4dc6ab87e9cb5f7a2dc88ff1cadb105b_JaffaCakes118
Size

412KB
MD5

4dc6ab87e9cb5f7a2dc88ff1cadb105b
SHA1

17b9278fb0824a333f1adf58881357be43ba13e2
SHA256

145455112fdd5ccb922eae8cbb5ae2d089b6807e8187fe9e993179933846e164
SHA512

7e4ec7304eb11d0c50c613e16483499b4366cd545be47fa361fe18bb43b3d4ce8f8a2d282852c2cd1043a6475f32be911d5b235cffbfbc75c707095756374e47
SSDEEP

6144:c4GbLdDiGGZ7XNlqylp1E35JJNhXq5rp9V9MgAOm/ZvoTxVX2gzB:ydVWXHNpWlXq5rnU/S/x

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4dc6ab87e9cb5f7a2dc88ff1cadb105b_JaffaCakes118

Files

4dc6ab87e9cb5f7a2dc88ff1cadb105b_JaffaCakes118
.exe windows:5 windows x86 arch:x86

7588b7dfe0f6203dc8025697afe65124

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteProcessMemory
CloseHandle
GetCurrentDirectoryA
GetModuleHandleA
WTSGetActiveConsoleSessionId
GetExitCodeThread
VirtualAllocEx
GetProcAddress
GetLastError
TerminateProcess
Sleep
VirtualFreeEx
CreateRemoteThread
WaitForSingleObject
GetCurrentProcess
MoveFileExA
GetProcessHeap
SetEndOfFile
CreateFileA
GetLocaleInfoW
CreateFileW
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
MultiByteToWideChar
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetCPInfo
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
ReadFile
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
SetFilePointer
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
LoadLibraryA

user32

MessageBoxA

advapi32

AdjustTokenPrivileges
OpenSCManagerA
SetServiceStatus
RegOpenKeyExA
LookupPrivilegeValueA
StartServiceA
CreateServiceA
RegisterServiceCtrlHandlerA
RegSetValueExA
StartServiceCtrlDispatcherA
OpenProcessToken
CloseServiceHandle
OpenServiceA
CreateProcessAsUserA
RegCloseKey

shell32

SHGetFolderPathA
SHGetSpecialFolderPathA

wtsapi32

WTSQueryUserToken

Sections

.text
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 294KB - Virtual size: 301KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7588b7dfe0f6203dc8025697afe65124

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

wtsapi32

Sections

.text Size: 89KB - Virtual size: 88KB

.rdata Size: 18KB - Virtual size: 18KB

.data Size: 294KB - Virtual size: 301KB

.rsrc Size: 512B - Virtual size: 448B

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 89KB - Virtual size: 88KB

.rdata
Size: 18KB - Virtual size: 18KB

.data
Size: 294KB - Virtual size: 301KB

.rsrc
Size: 512B - Virtual size: 448B

.reloc
Size: 8KB - Virtual size: 8KB