72e8989fe3982b7daf54bc6609ef118c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

72e8989fe3982b7daf54bc6609ef118c_JaffaCakes118
Size

186KB
MD5

72e8989fe3982b7daf54bc6609ef118c
SHA1

7ebd5522be464aed1ddf93e075eb5c7dd69e4f61
SHA256

92d04f87bd5c0ab6d46853367edfb4d4d23b2e6a49e2fc48d02e2f2cfde3a93d
SHA512

15e915e25b717043ab849c25ef8d4510ee52b52cacc1b23fc644bca03af74411afc5f1ce2b6dda6dcaf7619878f964dc5771eca4987dfd5f18330f1bb7fd5dc1
SSDEEP

3072:ecZreLGez0TMfFiGpPwkOaPTnb54gF346EbmNLMzgjMupdPK/:ecr81YT2Fiaxlrb6gF3yJmPPG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
72e8989fe3982b7daf54bc6609ef118c_JaffaCakes118

Files

72e8989fe3982b7daf54bc6609ef118c_JaffaCakes118
.exe windows:6 windows x86 arch:x86

da2666d3347f129193ab91a0eab85c0c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

userinit.pdb

Imports

ntdll

DbgPrint
RtlInitUnicodeString
NtOpenKey
NtClose

api-ms-win-core-localregistry-l1-1-0

RegCreateKeyExW
RegDeleteTreeW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW

api-ms-win-core-processthreads-l1-1-0

SetThreadPriority
GetCurrentThread
CreateThread
GetCurrentProcess
CreateProcessW
OpenProcessToken

user32

CharNextW
GetKeyboardLayout
GetSystemMetrics
ExitWindowsEx
MessageBoxW
LoadStringW
LoadRemoteFonts
DefWindowProcW
RegisterClassExW
DestroyWindow
CreateWindowExW
SystemParametersInfoW

userenv

ord175

msvcrt

_ismbblead
_XcptFilter
_exit
_cexit
exit
_wcsicmp
memset
memmove
_vsnwprintf
_initterm
_acmdln
_amsg_exit
__setusermatherr
__p__fmode
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
__getmainargs
__p__commode

kernel32

GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedExchange
LoadLibraryA
RegOpenKeyExA
RegQueryValueExA
ExpandEnvironmentStringsA
LoadLibraryExA
InterlockedCompareExchange
DelayLoadFailureHook
HeapSetInformation
SetCurrentDirectoryW
FormatMessageW
GetFileAttributesExW
GetSystemDirectoryW
SetLastError
ExpandEnvironmentStringsW
GetUserDefaultLangID
SetEvent
OpenEventW
Sleep
WaitForSingleObject
CloseHandle
GetLastError
SetEnvironmentVariableW
SearchPathW
GetCurrentThreadId
CompareFileTime
LoadLibraryW
GetProcAddress
FreeLibrary
GetEnvironmentVariableW
LocalAlloc
LocalFree
GetVersionExW
lstrlenW

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

PACK
Size: 160KB - Virtual size: 424KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

da2666d3347f129193ab91a0eab85c0c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-processthreads-l1-1-0

user32

userenv

msvcrt

kernel32

Sections

.text Size: 20KB - Virtual size: 19KB

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

PACK Size: 160KB - Virtual size: 424KB

.text
Size: 20KB - Virtual size: 19KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB

PACK
Size: 160KB - Virtual size: 424KB