a1bfee72283b4bbadd77e3a40d2791e8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a1bfee72283b4bbadd77e3a40d2791e8_JaffaCakes118
Size

85KB
MD5

a1bfee72283b4bbadd77e3a40d2791e8
SHA1

956e9dad9274f2099859ef2ef3c8cfbfffab6871
SHA256

378ebcb99d3b433e3e8f4b878fdf6b260c0ba7a3ca205bba4de4f754d16406c9
SHA512

17ba709d3cbf8c9328a12eea14c41a380639cafe43fd040c3753291af7277095774197b4b99fbfe5c56f25b94d5cc8979415090263a782c0824db3c22c3c293d
SSDEEP

1536:HoABQcMzzKcZuj0O/J7YQ/c4qanEvSsyNN+nQdfabpB8M3yb1pTa4Y:I4QcMzbY0mmQcV6z+nObLY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a1bfee72283b4bbadd77e3a40d2791e8_JaffaCakes118

Files

a1bfee72283b4bbadd77e3a40d2791e8_JaffaCakes118
.exe windows:5 windows x86 arch:x86

ac3597ebf9a5704b015299931f7ad323

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemTimeAsFileTime
GetStartupInfoA
FreeLibraryAndExitThread
GetPrivateProfileStringW
GetFileAttributesExW
CreateFileW
ConvertDefaultLocale
GetCurrentThreadId
DebugActiveProcessStop
GetExitCodeThread
GetVolumePathNameA
GlobalFree
GetDiskFreeSpaceExW
SetConsoleWindowInfo
CreateProcessInternalA
GetCurrentProcessId
GetCommTimeouts
LoadLibraryA
VirtualAlloc
SetConsoleInputExeNameW
ResetEvent
QueryPerformanceCounter
DeleteFiber
GetTickCount

expsrv

__vbaStrTextCmp
__vbaExitProc
__vbaBoolStr
rtcAppleScript
rtcCompareBstr
rtcJoin
__vbaCySgn
rtcFileWidth
Zombie_AddRef
SetMemObj
rtcLog
rtcExp
__vbaDateR8
__vbaVarSetVarAddref
rtcCreateObject
_adj_fptan
rtUI1FromErrVar

rasapi32

RasSetSubEntryPropertiesA
RasDialW
RasGetEntryPropertiesW
RasEditPhonebookEntryA
RasClearLinkStatistics
RasCreatePhonebookEntryA
RasGetEntryHrasconnW
RasScriptSend
RasEditPhonebookEntryW
RasValidateEntryNameA
RasGetCredentialsA
RasSetCredentialsW
RasGetConnectionStatistics
RasGetLinkStatistics
RasEnumEntriesW
RasSetAutodialEnableW
RasEnumAutodialAddressesA

wintrust

CryptCATOpen
WintrustAddDefaultForUsage
WintrustCertificateTrust
WTHelperGetKnownUsages
SoftpubDumpStructure
CryptCATPersistStore
CryptCATAdminPauseServiceForBackup
CryptSIPGetInfo
WVTAsn1SpcPeImageDataDecode
CryptCATCDFEnumAttributesWithCDFTag
GenericChainCertificateTrust
WVTAsn1SpcSpOpusInfoDecode
WVTAsn1SpcIndirectDataContentDecode

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac3597ebf9a5704b015299931f7ad323

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

expsrv

rasapi32

wintrust

Sections

.text Size: 29KB - Virtual size: 28KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 31KB - Virtual size: 90KB

.rsrc Size: 20KB - Virtual size: 20KB

.reloc Size: 512B - Virtual size: 348B

.text
Size: 29KB - Virtual size: 28KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 31KB - Virtual size: 90KB

.rsrc
Size: 20KB - Virtual size: 20KB

.reloc
Size: 512B - Virtual size: 348B