7211b7bdb1ec2b9f0a4062245c8786d1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

7211b7bdb1ec2b9f0a4062245c8786d1_JaffaCakes118
Size

162KB
MD5

7211b7bdb1ec2b9f0a4062245c8786d1
SHA1

84efe0457ec593dd53137807065657e4239041f8
SHA256

fe2d8f18fe369eda279606e6142e28d97c68f390623819fea29d0c66548aebe7
SHA512

b8124800dfe1e922680e213af0ff33a7881e7e60ef136884560d3344a8ad7acb31dd8a410759e5e47854d5bebaf3432118628c5d2b3a6fc7d2d1868f113f1e73
SSDEEP

3072:2GXTOO5u115Q2ZXJH1VC8CSzhYY6UvwzbfZw34A3YdJDNx:n5GNJHTCvu6kwzrZwoA3YdRNx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7211b7bdb1ec2b9f0a4062245c8786d1_JaffaCakes118

Files

7211b7bdb1ec2b9f0a4062245c8786d1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9a6781609b1138e24c199318f6807db8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mprapi

MprConfigServerConnect
MprConfigServerDisconnect
MprConfigGetFriendlyName

oleacc

LresultFromObject
AccessibleObjectFromPoint

shell32

SHGetFolderPathW

kernel32

WriteConsoleA
HeapCreate
HeapDestroy
LCMapStringA
MultiByteToWideChar
UnhandledExceptionFilter
HeapFree
IsValidCodePage
GetCurrentProcess
GetTimeZoneInformation
GetTimeFormatA
GetCPInfo
SetUnhandledExceptionFilter
RtlUnwind
FreeLibrary
LoadLibraryA
WriteFile
SetEndOfFile
ReadFile
GetACP
EnumResourceTypesA
LCMapStringW
VirtualFree
VirtualAlloc
HeapSize
RaiseException
GetStringTypeW
CompareStringW
GetCurrentProcessId
IsDebuggerPresent
CreateNamedPipeA
EnterCriticalSection
GetDateFormatA
LeaveCriticalSection
SetFilePointer
SetEnvironmentVariableA
QueryPerformanceCounter
GetOEMCP
GetLocaleInfoA
CompareStringA
TerminateProcess
GetConsoleOutputCP
GetTickCount
InitializeCriticalSection
SetStdHandle
HeapReAlloc
GetSystemTimeAsFileTime
GetStringTypeA

advapi32

CloseServiceHandle
RegOpenKeyExW
CreateServiceW
EqualSid
LookupPrivilegeNameA
LookupPrivilegeValueA
RegEnumKeyExW
SetSecurityDescriptorDacl
FreeInheritedFromArray
RegGetKeySecurity
RegDeleteValueW
RegSetValueExW
IsValidAcl
LookupAccountSidW
EnumDependentServicesW
RegDeleteKeyW
GetSecurityDescriptorControl
UnlockServiceDatabase
OpenSCManagerW
OpenProcessToken
InitializeAcl
ChangeServiceConfigW
AllocateAndInitializeSid
GetInheritanceSourceW
AdjustTokenPrivileges
LookupPrivilegeDisplayNameA
ControlService
ChangeServiceConfig2W
SetNamedSecurityInfoW
RegCloseKey
RegQueryValueExW
QueryServiceStatus
StartServiceA
GetTokenInformation
LockServiceDatabase
GetNamedSecurityInfoW
AddAce
OpenServiceW
IsValidSecurityDescriptor
GetSecurityInfo
GetAce
RegSaveKeyW
QueryServiceLockStatusW
FreeSid
RegRestoreKeyW
InitializeSecurityDescriptor
DeleteService
RegCreateKeyExW
SetSecurityInfo
QueryServiceConfigW
GetAclInformation
SetEntriesInAclW
SetEntriesInAclA
RegEnumValueW

newdev

UpdateDriverForPlugAndPlayDevicesW

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 407KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9a6781609b1138e24c199318f6807db8

Headers

File Characteristics

Imports

mprapi

oleacc

shell32

kernel32

advapi32

newdev

Sections

.text Size: 44KB - Virtual size: 43KB

.rdata Size: 3KB - Virtual size: 407KB

.data Size: 113KB - Virtual size: 113KB

.rsrc Size: 512B - Virtual size: 4KB

.text
Size: 44KB - Virtual size: 43KB

.rdata
Size: 3KB - Virtual size: 407KB

.data
Size: 113KB - Virtual size: 113KB

.rsrc
Size: 512B - Virtual size: 4KB