81cf0ab50def006e87814ef075560e79_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

81cf0ab50def006e87814ef075560e79_JaffaCakes118
Size

267KB
MD5

81cf0ab50def006e87814ef075560e79
SHA1

b850e2e8e81738bb0b67958c2d90d4d3f82aead8
SHA256

bbb250b6b82b5da20a11718d45d1dea4e760c2f9acdba594bf3021c1b2bd3676
SHA512

efbc932f672e12e68fda7b953c7a0518c056a398219a1897b020a8b407c4a6b4490b7a5c111b2f8116d6bbb0ef4894e4511fc95455751739dc79e191f9eec6b0
SSDEEP

6144:e9nHPoWtWBVJjMCPnsWmoQKSdEOWlzwaKNmnsimFfmwOEt4fqfI:8AvIcnsWACeaKNPFdOEafb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
81cf0ab50def006e87814ef075560e79_JaffaCakes118

Files

81cf0ab50def006e87814ef075560e79_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1633be624b6989d44728ca30804540e4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mprapi

MprConfigServerConnect
MprConfigServerDisconnect
MprConfigGetFriendlyName

oleacc

LresultFromObject
AccessibleObjectFromPoint

newdev

UpdateDriverForPlugAndPlayDevicesW

advapi32

GetSecurityInfo
RegEnumKeyExW
RegCloseKey
RegSetValueExW
CreateServiceW
SetSecurityInfo
RegDeleteValueW
StartServiceA
RegGetKeySecurity
AllocateAndInitializeSid
EqualSid
LookupPrivilegeDisplayNameA
RegRestoreKeyW
RegSaveKeyW
SetSecurityDescriptorDacl
IsValidSecurityDescriptor
OpenProcessToken
CloseServiceHandle
GetAclInformation
LookupPrivilegeValueA
InitializeAcl
EnumDependentServicesW
AdjustTokenPrivileges
QueryServiceLockStatusW
InitializeSecurityDescriptor
GetNamedSecurityInfoW
QueryServiceStatus
RegQueryValueExW
ControlService
GetAce
GetTokenInformation
OpenServiceW
ChangeServiceConfigW
FreeInheritedFromArray
IsValidAcl
UnlockServiceDatabase
ChangeServiceConfig2W
DeleteService
LockServiceDatabase
GetInheritanceSourceW
RegDeleteKeyW
RegCreateKeyExW
SetEntriesInAclW
OpenSCManagerW
SetEntriesInAclA
FreeSid
LookupAccountSidW
AddAce
QueryServiceConfigW
RegOpenKeyExW
GetSecurityDescriptorControl
SetNamedSecurityInfoW
LookupPrivilegeNameA
RegEnumValueW

shell32

SHGetFolderPathW

kernel32

GetSystemTimeAsFileTime
RtlUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetACP
LCMapStringW
LoadLibraryA
HeapCreate
HeapFree
GetOEMCP
LeaveCriticalSection
GetCurrentProcessId
HeapDestroy
GetDateFormatA
GetCPInfo
WriteFile
WriteConsoleA
GetCurrentProcess
ReadFile
GetTickCount
HeapReAlloc
SetUnhandledExceptionFilter
SetFilePointer
TerminateProcess
GetLocaleInfoA
CompareStringW
GetTimeZoneInformation
EnumResourceTypesA
SetEndOfFile
CreateNamedPipeA
CompareStringA
MultiByteToWideChar
LCMapStringA
GetStringTypeW
FreeLibrary
SetStdHandle
InitializeCriticalSection
SetEnvironmentVariableA
VirtualFree
HeapSize
EnterCriticalSection
GetConsoleOutputCP
IsValidCodePage
GetTimeFormatA
VirtualAlloc
QueryPerformanceCounter
RaiseException
GetStringTypeA

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 197KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1633be624b6989d44728ca30804540e4

Headers

File Characteristics

Imports

mprapi

oleacc

newdev

advapi32

shell32

kernel32

Sections

.text Size: 64KB - Virtual size: 64KB

.rdata Size: 3KB - Virtual size: 147KB

.data Size: 197KB - Virtual size: 197KB

.rsrc Size: 512B - Virtual size: 4KB

.text
Size: 64KB - Virtual size: 64KB

.rdata
Size: 3KB - Virtual size: 147KB

.data
Size: 197KB - Virtual size: 197KB

.rsrc
Size: 512B - Virtual size: 4KB