875f3fc948c6534804a26176dcfb6af0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

875f3fc948c6534804a26176dcfb6af0_JaffaCakes118
Size

296KB
MD5

875f3fc948c6534804a26176dcfb6af0
SHA1

6334a139db1b1e8fa6f0ba6c39af8d18e0920c1e
SHA256

fb9e181d3ea6faa9d0e7431bfc8301fd66bcc8c3d66b26cef7036d117ee5fbb1
SHA512

47e9098e7a27bc4289f0f39b3bd766c838b12e8f3c90499269d2ccef3d524c946ddb2a91292a8dd9a5a1e6dc70c53fdc8d26c5560c3066b67203c4a4572df08e
SSDEEP

3072:BU335ii49ypBetn7DCI/Y7g8ZOQwMT4D8Gp6o1IfO71AZayGkpXuJPEh3htu2:BU3pgaBetn7DFygGOozAHNy4Jsh62

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
875f3fc948c6534804a26176dcfb6af0_JaffaCakes118

Files

875f3fc948c6534804a26176dcfb6af0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8e4768db20d3f599a25a3eafdfa76428

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetTokenInformation
OpenProcessToken
LsaNtStatusToWinError
LsaOpenPolicy
LsaFreeMemory
LsaRetrievePrivateData
RegCloseKey
LsaClose
RegQueryInfoKeyW
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
CloseServiceHandle
DeleteService
StartServiceA
CreateServiceA
OpenSCManagerA
IsWellKnownSid
IsValidSid
RegQueryValueExW
RegEnumKeyW

shlwapi

SHDeleteKeyW

crypt32

CryptUnprotectData

psapi

GetModuleInformation
GetModuleBaseNameW
EnumProcessModules

secur32

LsaEnumerateLogonSessions
LsaFreeReturnBuffer

kernel32

SetEndOfFile
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
FreeLibrary
LocalFree
WriteFile
GetStdHandle
FormatMessageA
LoadLibraryExW
CloseHandle
OpenProcess
WideCharToMultiByte
GetProcAddress
LoadLibraryA
GetLastError
SetLastError
GetModuleHandleW
ReadFile
ReadProcessMemory
GetCurrentProcess
DuplicateHandle
CreatePipe
VirtualFreeEx
GetExitCodeThread
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
CreateThread
GetOverlappedResult
ConnectNamedPipe
CreateEventA
CreateNamedPipeA
GetCurrentProcessId
GetModuleFileNameA
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwind
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
GetCommandLineA
GetVersionExA
GetProcessHeap
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeA
GetStringTypeW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetHandleCount
GetFileType
GetStartupInfoA
HeapSize
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetLocaleInfoA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
GetLocaleInfoW

Sections

.text
Size: 232KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8e4768db20d3f599a25a3eafdfa76428

Headers

File Characteristics

Imports

advapi32

shlwapi

crypt32

psapi

secur32

kernel32

Sections

.text Size: 232KB - Virtual size: 228KB

.rdata Size: 44KB - Virtual size: 41KB

.data Size: 12KB - Virtual size: 19KB

.rsrc Size: 4KB - Virtual size: 176B

.text
Size: 232KB - Virtual size: 228KB

.rdata
Size: 44KB - Virtual size: 41KB

.data
Size: 12KB - Virtual size: 19KB

.rsrc
Size: 4KB - Virtual size: 176B