5bfd49ec731ce1f75bb41e617b208f50_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5bfd49ec731ce1f75bb41e617b208f50_JaffaCakes118
Size

121KB
MD5

5bfd49ec731ce1f75bb41e617b208f50
SHA1

52c5ef8b5f7642befdc64d3191f8b6c7b74676ac
SHA256

1c8b83618bb528afd4030650eb299b02bf59af5021a8dc0880b23b8462da0b07
SHA512

2017b94e1d7065c2930e36f45e5de4d6d302c116ffea5ae6eb656532e106119aa585b995e80a8b9c53351ad8b62ea78c3c933254b6080a3dc8dfe21f1edec305
SSDEEP

768:xwsgWj7Pz3GhDxrxwDiBkMOUwo4UXib1snBbStIgEoJcad6yLvbbkG:xVPz38Dm8OUDTECaoyPbkG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5bfd49ec731ce1f75bb41e617b208f50_JaffaCakes118

Files

5bfd49ec731ce1f75bb41e617b208f50_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f5c482918ecd01492194363194b69079

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\nps_vss_root\nps\bin\release\program files\NPSUserWebFeedback.pdb

Imports

mfc80u

ord3327
ord4255
ord4475
ord3943
ord2638
ord3703
ord1079
ord293
ord577
ord4032
ord3990
ord777
ord5558
ord6166
ord6172
ord774
ord6160
ord5524
ord283
ord266
ord1472
ord280
ord776
ord265
ord282
ord6700
ord1479
ord6161
ord899
ord896
ord557
ord745
ord2311
ord5711
ord1198
ord4008
ord6272
ord3795
ord6274
ord4320
ord2054
ord2009
ord5579
ord3800
ord1007
ord5096
ord1049
ord6215
ord3824
ord5378
ord3826
ord1911
ord2925
ord5220
ord5222
ord2239
ord3942
ord4562
ord5226
ord757
ord5209
ord566
ord5562
ord2531
ord2725
ord2829
ord4301
ord3677
ord2708
ord2832
ord4535
ord2534
ord2640
ord2527
ord3712
ord3713
ord764

msvcr80

__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
memset
_encode_pointer
_vswprintf_s_l
__set_app_type
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__CxxFrameHandler3
memcpy

kernel32

GlobalMemoryStatus
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
FreeLibrary
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetDiskFreeSpaceW
GetProcAddress
LoadLibraryW
GetVolumeInformationW
GetDriveTypeW
GetSystemDirectoryW
WideCharToMultiByte
GetTickCount
GetVersionExW
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
lstrlenW

advapi32

FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegOpenKeyExW
RegCloseKey
RegQueryValueExW

comctl32

InitCommonControlsEx

ole32

CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

SafeArrayUnaccessData
SafeArrayCreateVector
VariantInit
VariantClear
SysFreeString
SysAllocString
SafeArrayAccessData

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.krdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f5c482918ecd01492194363194b69079

Headers

File Characteristics

PDB Paths

Imports

mfc80u

msvcr80

kernel32

advapi32

comctl32

ole32

oleaut32

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 28KB - Virtual size: 27KB

.krdata Size: 68KB - Virtual size: 68KB

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 28KB - Virtual size: 27KB

.krdata
Size: 68KB - Virtual size: 68KB