97289702005eb5b7ea91f670dcb35abe_JaffaCakes118

General

Target

97289702005eb5b7ea91f670dcb35abe_JaffaCakes118
Size

283KB
MD5

97289702005eb5b7ea91f670dcb35abe
SHA1

16c90c0ee772053d168100a629fe50eb1ff58780
SHA256

772f981c92f897ff68dbffdc0be4363a8deba28361f017059723213177beb74f
SHA512

76cc7cd32967e69f584a3df7d92d61a1eb93d4ae00012e9d88ad54874beb4a748960067d02027198808683a16b39656dd6f07e5e49af7aef0e49c778a99ea49a
SSDEEP

6144:kra2ca/TMeqZYgS7zFDIqKjRrpKvmj9TDAbaiUTrudf:kra/0TM/ZYgS7O5BfFAf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
97289702005eb5b7ea91f670dcb35abe_JaffaCakes118

Files

97289702005eb5b7ea91f670dcb35abe_JaffaCakes118
.exe windows:4 windows x86 arch:x86

45c0e6b72e86bbae786d580e84844171

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mprapi

MprConfigServerConnect
MprConfigServerDisconnect
MprConfigGetFriendlyName

user32

EnumChildWindows
DestroyWindow
CreateWindowExW
GetDlgItem
SendMessageA
IsWindow
GetWindowThreadProcessId

newdev

UpdateDriverForPlugAndPlayDevicesW

shell32

SHGetFolderPathW

kernel32

WriteFile
GetStdHandle
TlsFree
GetEnvironmentStrings
GetFileType
TlsAlloc
AddAtomA
TlsSetValue
UnhandledExceptionFilter
GetCurrentProcessId
HeapSize
HeapCreate
GetSystemTimeAsFileTime
IsBadWritePtr
VirtualAlloc
TlsGetValue
FreeEnvironmentStringsA
EnumResourceLanguagesA
HeapDestroy
GetStartupInfoA
GetVersionExA
GetSystemInfo
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
VirtualQuery
lstrcpyW
GetCPInfo
GetLocaleInfoA
GetACP
InterlockedExchange
GetOEMCP
SetLastError
TerminateProcess
GetCurrentProcess
GetModuleFileNameA
VirtualFree
SetEndOfFile
QueryPerformanceCounter
SetUnhandledExceptionFilter

iphlpapi

GetIpAddrTable

setupapi

CM_Get_Parent
CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status

Sections

.text
Size: 145KB - Virtual size: 276KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

45c0e6b72e86bbae786d580e84844171

Headers

File Characteristics

Imports

mprapi

user32

newdev

shell32

kernel32

iphlpapi

setupapi

Sections

.text Size: 145KB - Virtual size: 276KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 135KB - Virtual size: 134KB

.rsrc Size: 512B - Virtual size: 4KB

.text
Size: 145KB - Virtual size: 276KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 135KB - Virtual size: 134KB

.rsrc
Size: 512B - Virtual size: 4KB