a35dca8d2837bedd56a89a80ba39730b_JaffaCakes118

General

Target

a35dca8d2837bedd56a89a80ba39730b_JaffaCakes118
Size

127KB
MD5

a35dca8d2837bedd56a89a80ba39730b
SHA1

fd5eb36d63bdbd22c48dd5b13a42e08105d6a027
SHA256

26881505a4f53167ddcfd7ed503fe4efff7eb96a8845a74579c087bbce369a75
SHA512

fc88a25ff37f611dccf84bf05668c1b546e1d84fb0009809480943e6354ec1c4306918313a89239f50e32fb81f6b255a64d4605257e0a9252a8806fa32a6530e
SSDEEP

3072:I4z/Y2dxHcLMFphR5CLF9SCP1GFOQ1wQEADuFTiYa:Lz/Ym8AT58huOQ1eAKVda

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a35dca8d2837bedd56a89a80ba39730b_JaffaCakes118

Files

a35dca8d2837bedd56a89a80ba39730b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6aa61c2ee90a8ecfeef1d9c8aef1e0e8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

??1type_info@@UAE@XZ
_CxxThrowException
strcpy
strrchr
printf
__CxxFrameHandler
_access
strcat
sprintf
strlen
??2@YAPAXI@Z
memset
memcpy
??3@YAXPAX@Z
_strcmpi

psapi

GetProcessMemoryInfo

kernel32

lstrcmpiA
Process32Next
CreateToolhelp32Snapshot
Process32First
OutputDebugStringA
GetLastError
CreateFileA
CloseHandle
GetCurrentProcess
ReadFile
SetFilePointer
WriteFile
GetFileSize
CreateProcessA
GetModuleFileNameA
GetModuleHandleA
GetTempPathA
MoveFileExA
CopyFileA
DeleteFileA
LockResource
SizeofResource
LoadResource
FindResourceA
GetVersionExA
WaitForSingleObject
GetStartupInfoA
Sleep
DeviceIoControl
GetWindowsDirectoryA
LoadLibraryA
GetCommandLineA
GetProcAddress
VirtualProtect
VirtualQuery
GetSystemDirectoryA

user32

PostQuitMessage
SetWindowLongA
SetTimer
KillTimer
DialogBoxParamA
GetWindowLongA
EndDialog

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CloseServiceHandle
DeleteService
ControlService
OpenServiceA
OpenSCManagerA
QueryServiceStatus
StartServiceA

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6aa61c2ee90a8ecfeef1d9c8aef1e0e8

Headers

File Characteristics

Imports

msvcrt

psapi

kernel32

user32

advapi32

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 1024B - Virtual size: 832B

.rsrc Size: 114KB - Virtual size: 114KB

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1024B - Virtual size: 832B

.rsrc
Size: 114KB - Virtual size: 114KB