5d80d1fa7258ca41c7b230064b1f58d4_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

5d80d1fa7258ca41c7b230064b1f58d4_JaffaCakes118
Size

436KB
MD5

5d80d1fa7258ca41c7b230064b1f58d4
SHA1

2bc7ff95c7157f1eca89a18bfcca9890969b8349
SHA256

3c931513457d43193a33209f96b1e40859d477c464c116f335e5ff8225455f72
SHA512

62c1cbf39615e7c67c3c11bf981a788b31d9564d7f5771b05ab815a5722a40905454e7d4abd9887b016491f4280b955af94aae20b84dce3f4ffc36399faa1373
SSDEEP

12288:pBfYxG4HSDV3BnKTCDdqs07t30JX9yu9FIQ:ffYxG4HSV3BKTC8sOSloKP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d80d1fa7258ca41c7b230064b1f58d4_JaffaCakes118

Files

5d80d1fa7258ca41c7b230064b1f58d4_JaffaCakes118
.exe windows:5 windows x86 arch:x86

02c7b7650830062517152e8007b39216

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

GetModuleFileNameExA

kernel32

HeapAlloc
WriteFile
CreateFileA
lstrcpyA
Process32Next
Sleep
GetExitCodeProcess
TerminateProcess
OpenProcess
lstrcmpiA
Process32First
CreateProcessA
lstrlenA
CreateDirectoryA
SleepEx
GetModuleFileNameA
SetEndOfFile
SetFilePointer
ReadFile
GetFileSize
LoadLibraryExA
GetComputerNameA
LocalFree
GetVersionExA
GetLocalTime
lstrcatA
WaitForSingleObject
MoveFileExA
GetModuleHandleA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetFileTime
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
HeapCreate
LCMapStringW
LCMapStringA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
HeapFree
GetProcessHeap
SetLastError
DeleteFileA
GetFileAttributesA
OpenMutexA
CloseHandle
InterlockedDecrement
ExpandEnvironmentStringsA
GetLastError
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
lstrcpynA
WideCharToMultiByte
FreeLibrary
LoadLibraryA
IsValidCodePage
GetProcAddress
GetFullPathNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetOEMCP
GetACP
GetCPInfo
HeapSize
GetCurrentThreadId
InterlockedIncrement
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetStdHandle
VirtualAlloc
DeleteCriticalSection
RtlUnwind
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
GetModuleHandleW
ExitProcess
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
GetFileType
GetConsoleCP
GetConsoleMode
GetCommandLineA
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
VirtualFree

user32

FindWindowA
SendMessageTimeoutA
GetClassNameA
IsWindowVisible
EnumWindows
GetWindowThreadProcessId
IsWindow

advapi32

LookupAccountNameA
ConvertSidToStringSidA
RegSetValueExA
RegDeleteKeyA
RegQueryInfoKeyA
RegEnumKeyA
RegDeleteValueA
RegCreateKeyA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegCloseKey
OpenSCManagerA
OpenServiceA
QueryServiceStatus
CloseServiceHandle

shell32

ShellExecuteA

oleaut32

VariantClear

shlwapi

StrNCatA
StrStrIA
wnsprintfA
StrChrA
StrToIntA
SHDeleteKeyA
PathFileExistsA

Sections

.text
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 254KB - Virtual size: 254KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

02c7b7650830062517152e8007b39216

Headers

DLL Characteristics

File Characteristics

Imports

psapi

kernel32

user32

advapi32

shell32

oleaut32

shlwapi

Sections

.text Size: 131KB - Virtual size: 131KB

.rdata Size: 31KB - Virtual size: 31KB

.data Size: 18KB - Virtual size: 28KB

.rsrc Size: 254KB - Virtual size: 254KB

.text
Size: 131KB - Virtual size: 131KB

.rdata
Size: 31KB - Virtual size: 31KB

.data
Size: 18KB - Virtual size: 28KB

.rsrc
Size: 254KB - Virtual size: 254KB