a0c136a46fcb6e8896d89159d4274f39_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a0c136a46fcb6e8896d89159d4274f39_JaffaCakes118
Size

26KB
MD5

a0c136a46fcb6e8896d89159d4274f39
SHA1

eaebe6c68d48a26aaeb74baf1fb4b4bdb8dd3937
SHA256

c13ff43ce564547c81861d3830b953f81ccab3b299ceec0602cb807a04e0a115
SHA512

579c424a794c312c114d65eea1839ea377c4cf3c534bb5bd880e9bb06fd4acc55dd23dfe300594cace1f831c624f56f76ef07269a89fc6c4471a709158f67721
SSDEEP

384:HSWShb/b4ZAGrGRXDb+OqqM0ul/0ovTxUuNsRunCF6G+PsMDjlCW:Hyhb/kGBDb+OE7yQULM9zsMPs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a0c136a46fcb6e8896d89159d4274f39_JaffaCakes118

Files

a0c136a46fcb6e8896d89159d4274f39_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f0e1f6aacb29ec80e956788aab2c295a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

VariantClear

setupapi

SetupCommitFileQueueW
SetupQueueCopyW
SetupSetDirectoryIdW
SetupDefaultQueueCallbackW
SetupCloseFileQueue
SetupInitDefaultQueueCallbackEx
SetupInstallFromInfSectionW
SetupTermDefaultQueueCallback
SetupGetLineTextW
SetupCloseInfFile
SetupOpenInfFileW
SetupFindFirstLineW
SetupFindNextLine
SetupOpenAppendInfFileW
SetupOpenFileQueue
SetupGetStringFieldW

advapi32

RegSetValueExW
GetTokenInformation
RegFlushKey
RegDeleteValueW
RegUnLoadKeyW
RegEnumKeyW
RegCloseKey
OpenProcessToken
FreeSid
EqualSid
RegLoadKeyW
AllocateAndInitializeSid
RegOpenKeyExA
AdjustTokenPrivileges
RegSetValueW
LookupPrivilegeValueW
RegOpenKeyExW
RegCreateKeyExW
RegSaveKeyW
RegEnumValueW
RegQueryValueExW
RegQueryValueExA
RegDeleteKeyW
RegQueryInfoKeyW

msvcrt

_adjust_fdiv
_wtoi
_vsnprintf
_wcsicmp
memset
_XcptFilter
malloc
_setjmp3
_wcsnicmp
_amsg_exit
longjmp
memmove
bsearch
_wtol
memcpy
free
_initterm
_vsnwprintf
_ultow

kernel32

GetStartupInfoA

rpcrt4

RpcStringFreeW

shlwapi

StrStrIW
PathCombineW
PathAddBackslashW
PathRemoveFileSpecW
PathAppendW
PathBuildRootW
StrChrW
PathFileExistsW
StrRChrW

gdi32

GetDeviceCaps
DeleteObject
GetObjectW
CreateFontIndirectW
GetStockObject

ole32

OleInitialize
OleUninitialize
CoTaskMemFree

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

ntdll

RtlAdjustPrivilege
NtAllocateVirtualMemory

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 5KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f0e1f6aacb29ec80e956788aab2c295a

Headers

DLL Characteristics

File Characteristics

Imports

oleaut32

setupapi

advapi32

msvcrt

kernel32

rpcrt4

shlwapi

gdi32

ole32

version

ntdll

Sections

.text Size: 4KB - Virtual size: 4KB

.rsrc Size: 15KB - Virtual size: 14KB

.data Size: 512B - Virtual size: 40KB

.rdata Size: 5KB - Virtual size: 80KB

.text
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 15KB - Virtual size: 14KB

.data
Size: 512B - Virtual size: 40KB

.rdata
Size: 5KB - Virtual size: 80KB