4e185636f95a2514b50da694e45d65f1_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

4e185636f95a2514b50da694e45d65f1_JaffaCakes118
Size

3.2MB
MD5

4e185636f95a2514b50da694e45d65f1
SHA1

0cabab57522aedb508916b81d41ac5df6740aee5
SHA256

da088060c98ea54c63cfcc9febb9d2f7b2483f3f709625aabd0dbf2061df9848
SHA512

4bc1dc19b99b4d964be783502c46b8ee6d8c5fe82acde192d91202757bbf0cdd19b7d8070f4c34b04405b4b4b449f0816cfa4fced029aeaff1a25f0cf95789d1
SSDEEP

98304:OAbpxJWQTTd96mkOTsoBLN8FRSzI9kqI7:OA1fWQTLDkOw4LNiRSNqI7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4e185636f95a2514b50da694e45d65f1_JaffaCakes118

Files

4e185636f95a2514b50da694e45d65f1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0727f5da12cd50ba3a482141c94c576a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSACloseEvent
WSAConnect
WSAAddressToStringA
WSACreateEvent
WSAWaitForMultipleEvents
WSAEnumNetworkEvents

userenv

EnterCriticalPolicySection
UnloadUserProfile
DeleteProfileA
CreateEnvironmentBlock
DestroyEnvironmentBlock

winmm

waveInClose
timeBeginPeriod
timeEndPeriod
waveInAddBuffer
waveInOpen
waveInStop
waveInStart

mpr

WNetAddConnection2A
WNetGetUniversalNameA
WNetGetUserA

netapi32

NetWkstaGetInfo
NetApiBufferFree
NetGetAnyDCName

comdlg32

GetFileTitleA
ChooseFontA
CommDlgExtendedError
GetSaveFileNameA
GetOpenFileNameA
ChooseColorA

comctl32

ImageList_Remove
ImageList_SetBkColor
ImageList_SetDragCursorImage
ImageList_SetIconSize
ImageList_Write
ImageList_AddMasked
ImageList_GetImageCount
ImageList_Destroy

kernel32

GetACP
GetCPInfo
WriteFile
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
GetOEMCP
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
HeapAlloc
HeapFree
GetCurrentProcess
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
UnhandledExceptionFilter
SetSystemPowerState
GetProcessHeap
GetLocalTime
CreateFileA
WriteConsoleW
VirtualProtect
GetEnvironmentVariableA
lstrcmpiA
ExitProcess
TerminateProcess

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 548KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0727f5da12cd50ba3a482141c94c576a

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

userenv

winmm

mpr

netapi32

comdlg32

comctl32

kernel32

Sections

.text Size: 36KB - Virtual size: 36KB

.rdata Size: 236KB - Virtual size: 236KB

.data Size: 548KB - Virtual size: 2.2MB

.idata Size: 4KB - Virtual size: 4KB

.tls Size: 4KB - Virtual size: 4KB

.rsrc Size: 52KB - Virtual size: 49KB

.text
Size: 36KB - Virtual size: 36KB

.rdata
Size: 236KB - Virtual size: 236KB

.data
Size: 548KB - Virtual size: 2.2MB

.idata
Size: 4KB - Virtual size: 4KB

.tls
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 52KB - Virtual size: 49KB