9724b6393ba3414cd1a93ce49766df31_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

9724b6393ba3414cd1a93ce49766df31_JaffaCakes118
Size

152KB
MD5

9724b6393ba3414cd1a93ce49766df31
SHA1

b6e6d0aeb5874cb7cd0f4fe575437897215b3a96
SHA256

371749157a75caab1fcdf6a2ae875bed5f981a8ef3fc33ee4a455c461a9ef071
SHA512

a91a52d493e9512b769ca4aaf44442ef758195e6734a3496eb142882de6cbf6350a029bd849795b82b02d8e7cddaa271f29465e3a234e6925ffe04c384744e9c
SSDEEP

3072:v6UyITB8ZGws/s7ENBoqpWWCU3yM6/x9vB9q9sAc+TV3UHGag5VOREs:ynIlqLs/sIqqpWWCU3l6P+9tb+HGag2f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9724b6393ba3414cd1a93ce49766df31_JaffaCakes118

Files

9724b6393ba3414cd1a93ce49766df31_JaffaCakes118
.exe windows:5 windows x86 arch:x86

0052057d7d1416d78b7088779a2bb424

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemTime
GetCurrentProcessId
EnterCriticalSection
WaitCommEvent
FindClose
DeleteFileA
GetFileAttributesA
CreateFileA
TerminateProcess
CreateProcessA
VirtualQuery
GetVersion
WriteFile
OpenEventA
CreateEventA
ExitProcess
HeapAlloc
SetUnhandledExceptionFilter
CreateThread
DosDateTimeToFileTime
ReadFile
GetCurrentThreadId
LeaveCriticalSection
SetFileAttributesA
SystemTimeToFileTime
HeapFree
LocalFileTimeToFileTime
GetDiskFreeSpaceA
SetLastError
GetProcessHeap
GetDriveTypeA
GetFileSize
MoveFileExA
FindNextFileA
GetSystemDirectoryA
MoveFileA
SetEndOfFile
GetProcAddress
GetExitCodeProcess
DeviceIoControl
GetSystemTimeAsFileTime
SetFileTime
FreeLibrary
QueryDosDeviceA
ExpandEnvironmentStringsA
FindFirstFileA
WideCharToMultiByte
SetErrorMode
lstrcpynA
SetThreadAffinityMask
CloseHandle
GetTickCount
GetCommandLineA
CopyFileA
QueryPerformanceCounter
DeleteCriticalSection
SetFilePointer
SetEvent
Sleep
GetVersionExA
GetModuleHandleA
GetCurrentDirectoryA
SetHandleContext
BackupWrite
RemoveDirectoryA

advapi32

OpenProcessToken
InitiateSystemShutdownA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
CryptGenRandom
CryptAcquireContextA
GetLengthSid
AddAccessAllowedAce
AllocateAndInitializeSid
GetTokenInformation
CryptReleaseContext

user32

SendDlgItemMessageA
SendMessageA
SetParent
LoadStringA
MessageBoxA
DialogBoxParamA
EndDialog
ShowWindow

ntdll

NtShutdownSystem
NtClose
NtOpenProcessToken
NtAdjustPrivilegesToken

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.kltxed
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 133KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0052057d7d1416d78b7088779a2bb424

Headers

File Characteristics

Imports

kernel32

advapi32

user32

ntdll

shell32

Sections

.text Size: 6KB - Virtual size: 5KB

.data Size: 8KB - Virtual size: 14KB

.kltxed Size: 3KB - Virtual size: 3KB

.edata Size: 133KB - Virtual size: 155KB

.text
Size: 6KB - Virtual size: 5KB

.data
Size: 8KB - Virtual size: 14KB

.kltxed
Size: 3KB - Virtual size: 3KB

.edata
Size: 133KB - Virtual size: 155KB