96e1853685b923aabbba630e4ca964ba_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

96e1853685b923aabbba630e4ca964ba_JaffaCakes118
Size

1.1MB
MD5

96e1853685b923aabbba630e4ca964ba
SHA1

8a0d1fcfd36ef4f105336e05fd777ca43c299175
SHA256

d28299741f7b825b4f0556b6fc3d277e2b151e4e33f32fd636faf70dfbdfa787
SHA512

236af0241c21f7239952b9b32aa2bce1c676ec826649b19afe21b84c91a8fc9b85a950f768ce80a58526ffa1f57d279e96d40ba9cd1a1e4a6e7f562b0f0a2bec
SSDEEP

24576:JaL19Kt3rVQO1t2DgoqVxDilyHR4iJkpPzHF7Hr+Ls3i46GfASLK:E19g3XCG8yxnCHpruW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
96e1853685b923aabbba630e4ca964ba_JaffaCakes118

Files

96e1853685b923aabbba630e4ca964ba_JaffaCakes118
.exe windows:5 windows x86 arch:x86

539ef45f25fbb3d43b6f2ddcb7b5c6d0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

netapi32

NetShareEnum
NetApiBufferSize
NetServerEnum
NetApiBufferFree
NetShareGetInfo

gdi32

Polygon
BitBlt
CombineRgn

shell32

SHGetDesktopFolder

kernel32

GetTimeZoneInformation
CloseHandle
LeaveCriticalSection
CreateThread
MultiByteToWideChar
GetExitCodeThread
VerSetConditionMask
GetSystemTimeAsFileTime
GetCurrentThread
GetProcessHeap
HeapAlloc
LockFile
LockResource
SetTapePosition
ReleaseMutex
WriteFile
GetProcAddress
HeapQueryInformation
DeleteCriticalSection
Sleep
SetFilePointer
GetCurrentProcess
VirtualAlloc
GetCurrentDirectoryA
SetEvent
GetTapeStatus
GetLastError
FreeLibrary
GetTapePosition
SystemTimeToTzSpecificLocalTime
FileTimeToLocalFileTime
TerminateProcess
GetSystemTime
OpenMutexA
SetLastError
FindVolumeMountPointClose
TerminateThread
WriteTapemark
SetEndOfFile
CreateMutexA
GetVersion
LocalFileTimeToFileTime
GetCurrentProcessId

msvcrt

wcschr
fclose
_wcsrev
_onexit
wcslen
mktime
__setusermatherr
wcscpy
_wfopen
_exit
isspace
memmove
_wcsupr
_controlfp
time
__p__fmode
wcstok
_filelength
fread

advapi32

GetTokenInformation
AddAccessAllowedAce
AllocateAndInitializeSid
CloseEncryptedFileRaw
RegFlushKey
SetSecurityDescriptorDacl
RegOpenKeyExA
ReadEncryptedFileRaw

ole32

CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CLSIDFromString
StringFromGUID2

user32

SendMessageA
ChildWindowFromPoint
DispatchMessageA
PostQuitMessage
InflateRect
KillTimer
DestroyIcon
ReleaseDC
SetActiveWindow
GetMessageA
FlashWindow
GetDesktopWindow
ShowWindow
WindowFromPoint
DestroyWindow
CallNextHookEx
SetTimer
UpdateWindow
CreateWindowExA
CreateIconIndirect
GetDC
GetWindowThreadProcessId
ScreenToClient
DefWindowProcA
GetIconInfo
TranslateMessage
RegisterClassExA

ntdll

NtSetQuotaInformationFile
towupper
wcscspn

setupapi

SetupFindNextLine
SetupCloseInfFile

syssetup

AsrFreeContext
AsrRestorePlugPlayRegistryData

Sections

.text
Size: 836KB - Virtual size: 836KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 332KB - Virtual size: 331KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

539ef45f25fbb3d43b6f2ddcb7b5c6d0

Headers

DLL Characteristics

File Characteristics

Imports

netapi32

gdi32

shell32

kernel32

msvcrt

advapi32

ole32

user32

ntdll

setupapi

syssetup

Sections

.text Size: 836KB - Virtual size: 836KB

.data Size: 332KB - Virtual size: 331KB

.rsrc Size: 5KB - Virtual size: 3.1MB

.text
Size: 836KB - Virtual size: 836KB

.data
Size: 332KB - Virtual size: 331KB

.rsrc
Size: 5KB - Virtual size: 3.1MB