a0fd5efbbd0ed297d69db168a4229b84_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a0fd5efbbd0ed297d69db168a4229b84_JaffaCakes118
Size

216KB
MD5

a0fd5efbbd0ed297d69db168a4229b84
SHA1

0b11aa41f3234efd007f7195f0b7531ed94b8de7
SHA256

1f6d68308a2a95963998bc7c9923b2bc1c42e80d1a84cfc3f8669e45783d1646
SHA512

cf90d83d208bc2e5f058ae839adba07e72c29d2cdb2501354dc3681496092785f9725e61a4cab92760f5980b78dc279e4129c441b0043d61fd3e91992df18ee8
SSDEEP

3072:VgCjo8FbjPmoCu1FYtHJ9I/H4z7YOlRBBIQOhwU65+CClb:CGVZjPmF2FYNI/H4z7YOlRcQOhj65+f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a0fd5efbbd0ed297d69db168a4229b84_JaffaCakes118

Files

a0fd5efbbd0ed297d69db168a4229b84_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bc18fbe84242c1727980d1296648f94d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MoveFileA
DeleteFileA
CreateFileA
RemoveDirectoryA
CreateDirectoryA
GetStdHandle
CreatePipe
SetStdHandle
GetCurrentProcess
GetCurrentDirectoryA
GetStartupInfoA
WriteFile
ReadFile
GetExitCodeProcess
OpenProcess
TerminateProcess
LoadLibraryA
GetProcAddress
GetVersionExA
CopyFileA
FindClose
FindNextFileA
FindFirstFileA
GetLastError
DuplicateHandle
CreateProcessA
FreeLibrary
CloseHandle
SetEvent
CreateEventA
GetSystemDirectoryA
WaitForSingleObject
FormatMessageA
lstrlenA
LocalFree
SetConsoleCtrlHandler
Sleep
GetModuleFileNameA
SetCurrentDirectoryA
GetCurrentThread

advapi32

StartServiceCtrlDispatcherA
DuplicateTokenEx
GetTokenInformation
OpenProcessToken
FreeSid
EqualSid
AllocateAndInitializeSid
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
AdjustTokenPrivileges
LookupPrivilegeValueA
RegSetValueExA
RegCreateKeyExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenServiceA
ControlService
QueryServiceStatus
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegisterEventSourceA
ReportEventA
DeregisterEventSource
SetServiceStatus
RegisterServiceCtrlHandlerA
SetThreadToken

crypt32

CryptQueryObject
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringA
CertFreeCertificateContext
CertCloseStore
CryptMsgClose

msvcrt

_read
_write
ftell
fseek
time
malloc
free
__CxxFrameHandler
_mbsicmp
atol
ctime
isspace
strchr
fprintf
_exit
_XcptFilter
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__dllonexit
_onexit
fclose
_close
_open
_fdopen
??2@YAPAXI@Z
_mbscmp
??3@YAXPAX@Z
mbstowcs
_vsnprintf
fgets
strncmp
sprintf
_stricmp
exit
printf
_getpid
_stat
memmove
realloc
_purecall

Sections

.text
Size: 180KB - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bc18fbe84242c1727980d1296648f94d

Headers

File Characteristics

Imports

kernel32

advapi32

crypt32

msvcrt

Sections

.text Size: 180KB - Virtual size: 177KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 20KB - Virtual size: 20KB

.data1 Size: 8KB - Virtual size: 4KB

.text
Size: 180KB - Virtual size: 177KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 20KB - Virtual size: 20KB

.data1
Size: 8KB - Virtual size: 4KB