5ac95b703a415130a91f53d85d296973_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5ac95b703a415130a91f53d85d296973_JaffaCakes118
Size

149KB
MD5

5ac95b703a415130a91f53d85d296973
SHA1

e617ea2697123731455ef28d1e40f8bb810e0357
SHA256

8aa63ce6c362af692f291bdb1800b892f2f699ddf31766f7026e73624db6b3f1
SHA512

61d2cba794939eeb151d72b521bfca27df37aa7c602600b5b082ad0ee4a2c8c354ed6513c6b2ad1fee7685fb49957fafbaeac9fbc10db916bd3c18f535baf670
SSDEEP

3072:0mSU8Xh15WuoM4kkxNBQkfhjgwbkQEc/BuNF/4kkbQzz33Fd6+zH:0NU8Xh15WfnkkxTzbpt/yqkkbQ33Fd6E

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ac95b703a415130a91f53d85d296973_JaffaCakes118

Files

5ac95b703a415130a91f53d85d296973_JaffaCakes118
.exe windows:5 windows x86 arch:x86

7fb2c7efe5b5ca95d73455ebd2101814

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_wtoi
wcslen
wcscat
_wcsnicmp
wcsstr
free
_initterm
malloc
_adjust_fdiv

kernel32

TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapAlloc
GetProcessHeap
HeapFree
DeleteCriticalSection
CloseHandle
ExpandEnvironmentStringsW
WaitForSingleObject
GetSystemTimeAsFileTime
lstrlenW
GetProcAddress
LoadLibraryW
SwitchToThread
InterlockedExchange
QueueUserAPC
DisableThreadLibraryCalls
GetLastError
LoadLibraryExW
FreeLibrary
CompareStringW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetTickCount

netsh.exe

MatchTagsInCmdLine
MatchEnumTag
PrintMessageFromModule
RegisterContext
RegisterHelper

ole32

CoInitializeEx
CoTaskMemFree
CoCreateInstance
CoSetProxyBlanket
CoTaskMemAlloc
StringFromGUID2
CoUninitialize

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

rpcrt4

RpcStringFreeW
RpcStringBindingComposeW
NdrClientCall2
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoExW
RpcBindingFree

rtutils

TraceRegisterExA
TraceDeregisterW
TraceVprintfExA

user32

LoadStringW

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.p102
Size: 512B - Virtual size: 186B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.0x9a9
Size: 512B - Virtual size: 186B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.kalqo
Size: 512B - Virtual size: 186B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.88111
Size: 512B - Virtual size: 186B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.9102
Size: 512B - Virtual size: 392B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.1827
Size: 512B - Virtual size: 186B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.7382
Size: 512B - Virtual size: 186B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.81721
Size: 201KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ajdiw
Size: 512B - Virtual size: 194B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.09a
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.09a5
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.09a6
Size: 512B - Virtual size: 186B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.11524
Size: 512B - Virtual size: 158B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.9a9s
Size: 201KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.a4a4
Size: 512B - Virtual size: 158B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7fb2c7efe5b5ca95d73455ebd2101814

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

netsh.exe

ole32

oleaut32

rpcrt4

rtutils

user32

Sections

.text Size: 17KB - Virtual size: 16KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 1KB - Virtual size: 2KB

.p102 Size: 512B - Virtual size: 186B

.0x9a9 Size: 512B - Virtual size: 186B

.kalqo Size: 512B - Virtual size: 186B

.88111 Size: 512B - Virtual size: 186B

.9102 Size: 512B - Virtual size: 392B

.1827 Size: 512B - Virtual size: 186B

.7382 Size: 512B - Virtual size: 186B

.81721 Size: 201KB - Virtual size: 200KB

.ajdiw Size: 512B - Virtual size: 194B

.09a Size: 512B - Virtual size: 208B

.09a5 Size: 512B - Virtual size: 216B

.09a6 Size: 512B - Virtual size: 186B

.11524 Size: 512B - Virtual size: 158B

.9a9s Size: 201KB - Virtual size: 200KB

.a4a4 Size: 512B - Virtual size: 158B

.rsrc Size: 17KB - Virtual size: 16KB

.reloc Size: 512B - Virtual size: 276B

.text
Size: 17KB - Virtual size: 16KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1KB - Virtual size: 2KB

.p102
Size: 512B - Virtual size: 186B

.0x9a9
Size: 512B - Virtual size: 186B

.kalqo
Size: 512B - Virtual size: 186B

.88111
Size: 512B - Virtual size: 186B

.9102
Size: 512B - Virtual size: 392B

.1827
Size: 512B - Virtual size: 186B

.7382
Size: 512B - Virtual size: 186B

.81721
Size: 201KB - Virtual size: 200KB

.ajdiw
Size: 512B - Virtual size: 194B

.09a
Size: 512B - Virtual size: 208B

.09a5
Size: 512B - Virtual size: 216B

.09a6
Size: 512B - Virtual size: 186B

.11524
Size: 512B - Virtual size: 158B

.9a9s
Size: 201KB - Virtual size: 200KB

.a4a4
Size: 512B - Virtual size: 158B

.rsrc
Size: 17KB - Virtual size: 16KB

.reloc
Size: 512B - Virtual size: 276B