64754af0a922d278adaa9df8d06447f1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

64754af0a922d278adaa9df8d06447f1_JaffaCakes118
Size

54KB
MD5

64754af0a922d278adaa9df8d06447f1
SHA1

47e62a9cfbbf7fcba9fb215015a8d44a9ad223e7
SHA256

440f79f962eb138328f313c7c230fbbdf46acb942c5b556843c2168afbbf4815
SHA512

86df88edad02663bc463015e3cb684f6bf48eed6e595d7a360a36abd451f3f86d6d00883f7f2bfd4205a42217c357f6499c2b6a1b26b7b66da562a842b471d06
SSDEEP

768:tPVA2HWDmxy7BvOFnjGx+uJgCR6OxSUNgi9Z/BJTP7K+fZM4gU1S9HKKVBWZv7q:tPGIWuks/uJg0t7TjKuM4LY8KVBMD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64754af0a922d278adaa9df8d06447f1_JaffaCakes118

Files

64754af0a922d278adaa9df8d06447f1_JaffaCakes118
.dll windows:4 windows x86 arch:x86

57f6db956546e95150bbe9a7ed2cdcaa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FormatMessageW
WriteConsoleW
LocalAlloc
WriteFile
LocalFree
GetStdHandle
GetFileType
GetConsoleMode
LoadLibraryW
GetLastError
GetProcAddress
SetLastError
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
Sleep
InterlockedExchange
InterlockedCompareExchange
HeapFree
GetCurrentProcess
GetCurrentDirectoryW
LoadLibraryExA
ResumeThread
SetEvent
UnregisterWait
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
QueueUserWorkItem
TerminateProcess
CloseHandle
WriteProcessMemory
DuplicateHandle
ReadProcessMemory
GetCurrentThread
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
HeapAlloc
GetProcessHeap
FreeLibrary
GetTickCount
GetCommandLineA
OpenProcess
VirtualProtect

user32

CharToOemW

advapi32

RegQueryValueExW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegCloseKey
RegOpenKeyExW

rpcrt4

RpcServerRegisterIfEx
RpcServerUseProtseqEpW
RpcServerUnregisterIf
RpcRevertToSelfEx
RpcImpersonateClient

msvcrt

_wtoi
_vsnwprintf
_except_handler3
_initterm
memset
_wcsicmp
_XcptFilter
free
malloc
_adjust_fdiv
__CxxFrameHandler
_unlock

msvcp60

??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??Ostd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z

Sections

.text
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

57f6db956546e95150bbe9a7ed2cdcaa

Headers

File Characteristics

Imports

kernel32

user32

advapi32

rpcrt4

msvcrt

msvcp60

Sections

.text Size: 46KB - Virtual size: 46KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 34KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 46KB - Virtual size: 46KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 34KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB