601cbc528d155774121b61daa50c8b54_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

601cbc528d155774121b61daa50c8b54_JaffaCakes118
Size

256KB
MD5

601cbc528d155774121b61daa50c8b54
SHA1

c52f3321cb66982606b2b2ea8a2a5d0e2a097533
SHA256

f5d7d71f0c419d17a45dd5ee82292ce004d4aef8ca849278b429a8d51236e03c
SHA512

7b3d93b8a2a6e592a45b935fe085eea30035989339885925fca0d12ccfcf36c7be7ffb841e902fe7e1125c5510f84c9acdf1a946dfc0d58c7a73c6c3529199b7
SSDEEP

6144:ZlE9AeNGBHzsMBvN8JAi0IpH+QR9g7JkwIJ8l1rs4:ZlPeazoJc0+Q3g7Jkes4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
601cbc528d155774121b61daa50c8b54_JaffaCakes118

Files

601cbc528d155774121b61daa50c8b54_JaffaCakes118
.exe windows:0 windows x86 arch:x86

ce3ff7742a3f6c9baa49972d53950398

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCreateKeyW
RegCreateKeyExW
GetLengthSid
RegSetValueW
OpenProcessToken
SetSecurityDescriptorGroup
InitializeSecurityDescriptor
GetTokenInformation
SetSecurityDescriptorDacl
RegSetValueExW
CopySid
RegDeleteKeyW

user32

MoveWindow
CreateWindowExW
OpenDesktopW
InflateRect
CallWindowProcW
GetDC
GetUserObjectInformationW
GetDoubleClickTime
RegisterWindowMessageW
GetMessageW
RegisterDeviceNotificationW
LoadImageW
MonitorFromPoint
GetWindowLongW
ClientToScreen
MonitorFromWindow
DestroyIcon
SystemParametersInfoW
PostThreadMessageW
ShowWindow
EnumDisplaySettingsW
SetCursorPos
PostMessageW
SetThreadDesktop
GetDesktopWindow
SetWindowsHookExW
GetThreadDesktop
UnregisterDeviceNotification
WindowFromPoint
GetClientRect
IntersectRect
DestroyWindow
CallNextHookEx

atl

ord58
ord18
ord16
ord45
ord57
ord43

msvcrt

swscanf
??3@YAXPAX@Z
_adjust_fdiv
_controlfp
_except_handler3
_c_exit
_onexit
wcscmp
_cexit
_initterm
wcscpy
_CIpow
_wcsicmp
wcstol
_wfopen
__setusermatherr
_XcptFilter
??1type_info@@UAE@XZ
_ftol
wcsstr
_CxxThrowException
__wgetmainargs
_vsnwprintf
_beginthreadex

ole32

CoInitializeSecurity
CoTaskMemFree

kernel32

SetPriorityClass
SetThreadExecutionState
GetCommandLineW
GetProcessHeap
LeaveCriticalSection
VirtualAlloc
EnterCriticalSection
GetTickCount
FlushInstructionCache
DeleteCriticalSection
CancelIo
GetProcessWorkingSetSize
GlobalDeleteAtom
WaitForMultipleObjects
ResetEvent
InitializeCriticalSection
SetThreadPriority
CloseHandle
ReadFile
UnmapViewOfFile
VirtualFree
QueryPerformanceFrequency
InitializeCriticalSectionAndSpinCount
MapViewOfFile
GetTickCount
MulDiv
GetOverlappedResult
GetProcAddress
SetPriorityClass
QueryPerformanceCounter
InterlockedIncrement
CreateMutexW
SetProcessShutdownParameters
GetModuleHandleA
GetStartupInfoW
lstrcpyW
ReleaseMutex
SetWaitableTimer

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW

gdi32

GetDeviceCaps
SelectObject
CreateCompatibleDC
CreateSolidBrush
DeleteDC

hid

HidP_GetSpecificValueCaps
HidP_MaxUsageListLength

Sections

.text
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 560KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ce3ff7742a3f6c9baa49972d53950398

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

user32

atl

msvcrt

ole32

kernel32

setupapi

gdi32

hid

Sections

.text Size: 164KB - Virtual size: 164KB

.data Size: 78KB - Virtual size: 78KB

.rsrc Size: 12KB - Virtual size: 560KB

.text
Size: 164KB - Virtual size: 164KB

.data
Size: 78KB - Virtual size: 78KB

.rsrc
Size: 12KB - Virtual size: 560KB