5d99bbff42c3fdca0d56a8c8c1eaa631_JaffaCakes118

General

Target

5d99bbff42c3fdca0d56a8c8c1eaa631_JaffaCakes118
Size

283KB
MD5

5d99bbff42c3fdca0d56a8c8c1eaa631
SHA1

4ddd3f781665fa2bd647b07deeba77e10c14cb54
SHA256

45cc3092bec81611757b24960dc427ceab535e82bb924ee47fe61bceac3e789e
SHA512

e91e34c828b4a628a133e717bf2b24dac607db601e9f61f18c9bbf95a520b8918dae31436a6932465f12ec3a54ed4d47a1f7e196f6ec286bdc5c64720e74340f
SSDEEP

6144:lASNZi/3yUIGnx2Y9wfYpAhn5JuyqiN4hMrzxalTtO:NNsvRIGom+siNGmFv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d99bbff42c3fdca0d56a8c8c1eaa631_JaffaCakes118

Files

5d99bbff42c3fdca0d56a8c8c1eaa631_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4733a4721792f3491a6c8677d2928537

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

newdev

UpdateDriverForPlugAndPlayDevicesW

user32

DestroyWindow
IsWindow
CreateWindowExW
GetDlgItem
EnumChildWindows
SendMessageA
GetWindowThreadProcessId

shell32

SHGetFolderPathW

kernel32

AddAtomA
HeapDestroy
GetEnvironmentStringsW
WriteFile
GetFileType
FreeEnvironmentStringsA
GetCurrentProcessId
HeapSize
VirtualFree
GetStartupInfoA
GetModuleFileNameA
InterlockedExchange
HeapCreate
IsBadWritePtr
GetSystemTimeAsFileTime
GetCurrentProcess
TlsFree
TerminateProcess
UnhandledExceptionFilter
EnumResourceLanguagesA
GetLocaleInfoA
TlsSetValue
VirtualAlloc
FormatMessageW
SetHandleCount
GetEnvironmentStrings
GetOEMCP
GetStdHandle
SetEndOfFile
GetCPInfo
QueryPerformanceCounter
VirtualQuery
SetLastError
GetVersionExA
TlsAlloc
GetACP
GetSystemInfo
FreeEnvironmentStringsW
TlsGetValue
SetUnhandledExceptionFilter

mprapi

MprConfigServerConnect
MprConfigServerDisconnect
MprConfigGetFriendlyName

setupapi

CM_Get_Parent
CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status

iphlpapi

GetIpAddrTable

Sections

.text
Size: 144KB - Virtual size: 279KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4733a4721792f3491a6c8677d2928537

Headers

File Characteristics

Imports

newdev

user32

shell32

kernel32

mprapi

setupapi

iphlpapi

Sections

.text Size: 144KB - Virtual size: 279KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 136KB - Virtual size: 135KB

.rsrc Size: 512B - Virtual size: 4KB

.text
Size: 144KB - Virtual size: 279KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 136KB - Virtual size: 135KB

.rsrc
Size: 512B - Virtual size: 4KB