84130bcdc071e2f23aa745755a08ec36_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

84130bcdc071e2f23aa745755a08ec36_JaffaCakes118
Size

289KB
MD5

84130bcdc071e2f23aa745755a08ec36
SHA1

13ff0546a88fe22ee2945910f1772f57b07f15a2
SHA256

7ab0cbf91eb6ee1d32d3d64f32ccc0fb7ca807d3f3b8a53a46d7d8274edfd2f5
SHA512

8c012de069d4c9e7f2f15919a44e77149dea01cd6230b851fe0f17682b991956015bb1a33b8f14e77a95e510194e28bbf44f03ce727a588edee393f49ec84b1a
SSDEEP

6144:YGXtKGZ0b/TNPFVtii2geGmkZiPhmjtUyBNGHF1D9xRB3:YGIPLIkcZmjtxwRB3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
84130bcdc071e2f23aa745755a08ec36_JaffaCakes118

Files

84130bcdc071e2f23aa745755a08ec36_JaffaCakes118
.exe windows:5 windows x64 arch:x64

e96a73c7bf33a464c510ede582318bf2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

psapi

GetModuleInformation

advapi32

CloseServiceHandle
OpenThreadToken
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetTokenInformation
NotifyChangeEventLog
OpenEventLogA
GetNumberOfEventLogRecords
GetOldestEventLogRecord
ReadEventLogA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
QueryServiceStatus
CreateServiceA
OpenSCManagerA
DeleteService
OpenServiceA
StartServiceA
ControlService
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
RegCloseKey
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegQueryValueExA

secur32

LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions

ws2_32

ntohl
ntohs
htonl

kernel32

CreateEventA
CreateFileW
GetProcessHeap
SetEndOfFile
WriteConsoleW
SetEnvironmentVariableA
CompareStringW
DeleteFileA
GetModuleHandleA
OpenProcess
Sleep
SetConsoleCtrlHandler
GetCurrentDirectoryA
GetTempPathA
GetVersionExA
ProcessIdToSessionId
GetCurrentProcessId
GetModuleFileNameA
GetCurrentProcess
LoadLibraryA
IsBadReadPtr
Process32Next
CloseHandle
Process32First
CreateToolhelp32Snapshot
ReadProcessMemory
WaitForSingleObject
CreateRemoteThread
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
GetProcAddress
TerminateProcess
MultiByteToWideChar
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateFileA
SizeofResource
LockResource
LoadResource
FindResourceA
FreeResource
ResetEvent
GetLastError
ReadFile
FreeLibrary
GetSystemWindowsDirectoryA
SetEvent
CreateThread
WriteFile
WaitNamedPipeA
FlushFileBuffers
DisconnectNamedPipe
ConnectNamedPipe
CreateNamedPipeA
WideCharToMultiByte
FileTimeToSystemTime
FileTimeToLocalFileTime
GetCurrentThread
GetModuleHandleW
ExitProcess
DecodePointer
HeapFree
HeapAlloc
EncodePointer
EnterCriticalSection
LeaveCriticalSection
HeapReAlloc
GetCommandLineA
RtlUnwindEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
LoadLibraryW
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
GetModuleFileNameW
HeapSetInformation
GetVersion
HeapCreate
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetFilePointer
SetStdHandle
LCMapStringW
GetStringTypeW

Sections

.text
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 121KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e96a73c7bf33a464c510ede582318bf2

Headers

DLL Characteristics

File Characteristics

Imports

psapi

advapi32

secur32

ws2_32

kernel32

Sections

.text Size: 122KB - Virtual size: 121KB

.rdata Size: 17KB - Virtual size: 16KB

.data Size: 22KB - Virtual size: 33KB

.pdata Size: 4KB - Virtual size: 4KB

.rsrc Size: 121KB - Virtual size: 124KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 122KB - Virtual size: 121KB

.rdata
Size: 17KB - Virtual size: 16KB

.data
Size: 22KB - Virtual size: 33KB

.pdata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 121KB - Virtual size: 124KB

.reloc
Size: 1KB - Virtual size: 1KB