8ee7f3f5842460ebaad475cf1909b5e7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8ee7f3f5842460ebaad475cf1909b5e7_JaffaCakes118
Size

62KB
MD5

8ee7f3f5842460ebaad475cf1909b5e7
SHA1

1363f608ea45a391eccc85c95e94548a64b49740
SHA256

a6855e44a14696cbcf773b419be681ea6eb46fd6f257f76ca6e25056af70f50d
SHA512

76551e7adc2730ba2bcdc88c322d468b2587cdd7c482ebfb653ec4e6c84af9f5ab3ae0d2ce377bc34a921f1f5e81f1ccdf7416a22622f1b3711fbaa57cb27b6e
SSDEEP

768:WvnVe/uFTzDdK8U6w1HC8s2xmHFdnuQ+Utk7BCgRt3pp5pvCXQZS0cQ965oaVxne:WvdDdNUhqFdnIqkTR7JCQIMIlxM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8ee7f3f5842460ebaad475cf1909b5e7_JaffaCakes118

Files

8ee7f3f5842460ebaad475cf1909b5e7_JaffaCakes118
.exe windows:6 windows x86 arch:x86

25cbf762fd20bb5948ee1f6eb9edede6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

ocsetup.pdb

Imports

advapi32

TraceMessage
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
ControlTraceW
EnableTrace
StartTraceW
RegCloseKey
RegOpenKeyExW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
EventUnregister
EventWrite
EventRegister
RegQueryValueExW

kernel32

GetEnvironmentVariableW
GetCurrentProcess
GetLastError
GetFullPathNameW
LocalFree
lstrlenW
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
IsWow64Process
GetCommandLineW
Wow64EnableWow64FsRedirection
GetSystemDirectoryW
InterlockedDecrement
InterlockedIncrement
FormatMessageW
GetCurrentProcessId
GetSystemWindowsDirectoryW
CreateFileW
FindFirstFileW
FindClose
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
CloseHandle
GetModuleHandleW

user32

MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW

msvcrt

wcsrchr
memset
??2@YAPAXI@Z
??3@YAXPAX@Z
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
memcpy
malloc
memmove
free
_vsnwprintf
_wcsicmp
_wcsnicmp
_wcslwr
_amsg_exit

shell32

CommandLineToArgvW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust
CryptCATCatalogInfoFromContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminAcquireContext
CryptCATAdminReleaseContext
CryptCATAdminCalcHashFromFileHandle
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain

crypt32

CryptHashPublicKeyInfo

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pogreyx
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

25cbf762fd20bb5948ee1f6eb9edede6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

shell32

wintrust

crypt32

ole32

Sections

.text Size: 26KB - Virtual size: 26KB

.data Size: 512B - Virtual size: 960B

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 30KB - Virtual size: 31KB

pogreyx Size: - Virtual size: 4KB

.text
Size: 26KB - Virtual size: 26KB

.data
Size: 512B - Virtual size: 960B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 30KB - Virtual size: 31KB

pogreyx
Size: - Virtual size: 4KB