735a98e7cc146249f572dc3245079d92_JaffaCakes118

General

Target

735a98e7cc146249f572dc3245079d92_JaffaCakes118
Size

64KB
MD5

735a98e7cc146249f572dc3245079d92
SHA1

94cea807856d24819037b20ad2770b542c9ad8ff
SHA256

45f33bb3a5880edcd978891c7317b1a00d7087e5e9c6c29e9b37e3d6784ed608
SHA512

5ad22d8931869dc357c6d69f3a4b74678cba8cb3f0e1f661e6253b6ef32b86a7ab1dde46d7dd8848ffc689b3f6664306f1c4758a67f453bba44216107dcc8d3e
SSDEEP

1536:z74qmUDURKn4KWaT4qgTc+BZhotCMao+nMA/oe:zEhUDURKn4ra8q+hoXao+nMA/oe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
735a98e7cc146249f572dc3245079d92_JaffaCakes118

Files

735a98e7cc146249f572dc3245079d92_JaffaCakes118
.exe windows:4 windows x86 arch:x86

779dd18915135df89fd3ea69f5d6cb11

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SizeofResource
FindResourceA
LoadResource
FreeResource
SetLastError
lstrcpyA
GetCurrentThreadId
HeapFree
GetPrivateProfileStringA
WritePrivateProfileStringA
GetModuleFileNameA
lstrlenA
lstrcatA
MultiByteToWideChar
WideCharToMultiByte
GetTickCount
GetSystemDirectoryA
Sleep
GetLastError
GetProcessHeap
HeapAlloc
GetModuleHandleA
GetProcAddress

user32

wsprintfA
GetMessageA
PostThreadMessageA
GetInputState

advapi32

GetAclInformation
DeleteService
OpenSCManagerA
OpenServiceA
CloseServiceHandle
StartServiceA
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
LookupAccountNameA
GetFileSecurityA
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetLengthSid
InitializeAcl
GetAce
EqualSid
AddAce
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
RegQueryValueExA
CreateServiceA
GetUserNameA
QueryServiceStatus
SetFileSecurityA
ControlService

shlwapi

SHDeleteKeyA

netapi32

NetUserGetLocalGroups
NetApiBufferFree

msvcrt

strlen
fwrite
fclose
strchr
srand
rand
memcpy
fopen
memset
_except_handler3
_stricmp

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

779dd18915135df89fd3ea69f5d6cb11

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

netapi32

msvcrt

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 952B

.rsrc Size: 56KB - Virtual size: 56KB

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 952B

.rsrc
Size: 56KB - Virtual size: 56KB