8dbfc3704a447ac727aa345b3671ee6d_JaffaCakes118

General

Target

8dbfc3704a447ac727aa345b3671ee6d_JaffaCakes118
Size

28KB
MD5

8dbfc3704a447ac727aa345b3671ee6d
SHA1

10b3b2d6eafa611535072491e679516d941c783b
SHA256

2da1745e7b4dcb31fc6cd75bc8297fc6aa39d93adc3388796bba8ae1f45b9cfe
SHA512

56211d41a491b5608c799e60ff3e88c5d2b16846255accf1f757f8ffbcc67d83fe20d6d6e9abaebd186d2cfeaaae84c8e779f7bdeac5addd84810893dd7488a8
SSDEEP

192:krRgJvd8kc7UWTbv61s2X72+4t/L5Fikuq2cwB7viPmFTc3qhdwO1DcmqN7Jd3SC:RB87Qeg7Kz58kj6vId3SYmxFnJdED

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8dbfc3704a447ac727aa345b3671ee6d_JaffaCakes118

Files

8dbfc3704a447ac727aa345b3671ee6d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

899ab9564dd4277d823a2e50f77feed6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalAlloc
Sleep
GetModuleFileNameA
FormatMessageA
CreateDirectoryA
CopyFileA
DeleteFileA
MoveFileA
_lclose
_lwrite
_llseek
_lcreat
_lopen
GetLocalTime
GetCurrentThread
GetCurrentThreadId
WaitForMultipleObjects
lstrcpyA
DisconnectNamedPipe
WriteFile
GetOverlappedResult
ReadFile
ConnectNamedPipe
SetLastError
ResetEvent
CreateNamedPipeA
CreateEventA
SetEvent
FreeResource
ExpandEnvironmentStringsA
LockResource
LoadResource
FindResourceA
GetVersionExA
lstrcmpiA
LocalFree
CreateProcessA
GetLastError
WaitForSingleObject
CloseHandle
EnterCriticalSection
LeaveCriticalSection
CreateThread
lstrlenA
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
DebugBreak
DeleteCriticalSection
InitializeCriticalSection
GetModuleHandleA
GetCommandLineA
ExitProcess
GetStartupInfoA
GetProcAddress
lstrcpynA

user32

CharNextA
wsprintfA

advapi32

OpenThreadToken
RevertToSelf
RegCreateKeyExA
RegSetValueExA
RegCloseKey
OpenServiceA
ControlService
DeleteService
OpenSCManagerA
CreateServiceA
StartServiceA
QueryServiceStatus
CloseServiceHandle
RegisterEventSourceA
ReportEventA
DeregisterEventSource
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
ImpersonateNamedPipeClient
InitializeSecurityDescriptor
DuplicateTokenEx

shlwapi

SHDeleteValueA
SHDeleteKeyA

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

899ab9564dd4277d823a2e50f77feed6

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

Sections

.text Size: 11KB - Virtual size: 11KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 2KB

.text
Size: 11KB - Virtual size: 11KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB