ab8dc664375043fdab643c2af46a24ad_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ab8dc664375043fdab643c2af46a24ad_JaffaCakes118
Size

157KB
MD5

ab8dc664375043fdab643c2af46a24ad
SHA1

5ee8733c1979fcbfca51e082e41504dba349c9c4
SHA256

ee2cd4a37de2b4ef2e849bd25b61744652880226e05fa6a8edd136fe10531c40
SHA512

40f13b34665da6c69762ef78a02b48323cbe55b587d59cc78ff6323b4e53884862a4ac2eef2b00fa1d1fe8f63562641c6a4afd11a7dc2fa8f01f68bde710e891
SSDEEP

3072:blebmCcl2W6dVBn9QFuF/dCfNV+HNHhG5I1qt6CowWWIMhW8k5iPMNGV/AxWh:RumCc6dV19QIlCfNV+HNHhG5I1qGwWWf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab8dc664375043fdab643c2af46a24ad_JaffaCakes118

Files

ab8dc664375043fdab643c2af46a24ad_JaffaCakes118
.exe windows:1 windows x86 arch:x86

2ca60fc2ce872245e4281dd3fb8ddbdf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteW

kernel32

FindClose
GetCurrentProcess
DeleteFileW
GetSystemDefaultLCID
GetModuleHandleA
GetModuleHandleExA
GetSystemRegistryQuota
VirtualFree
WriteFile
CreateFileA
DuplicateHandle
lstrcatA
lstrcpyA
FindFirstFileA
EnterCriticalSection
CloseHandle
GetFileSizeEx
GetTickCount
SetSystemPowerState
OpenProcess
InitializeCriticalSection
GetWindowsDirectoryA
SetConsoleActiveScreenBuffer
GetModuleFileNameA
DeleteFileA
RegisterConsoleOS2
EscapeCommFunction
GetSystemDirectoryA
GetLastError
GetDllDirectoryA
DeleteCriticalSection
IsValidUILanguage
Sleep
GetConsoleCommandHistoryLengthA
SetProcessPriorityBoost
SetComputerNameExW
VirtualAlloc
CopyFileA
lstrcatW
ClearCommBreak
GetLocaleInfoA
GetConsoleCP
GetProcAddress
VirtualQueryEx
ReadFile
FindCloseChangeNotification
LeaveCriticalSection
CreateFileW
CreateSemaphoreA
GetVolumePathNameW
FindNextFileA
GetSystemDirectoryW
lstrcpyW
GetEnvironmentStringsA
lstrlenA

advapi32

RegCreateKeyA
RegCloseKey
RegSetValueExA
PrivilegedServiceAuditAlarmW
RegOpenKeyA
OpenProcessToken
RegCreateKeyExA
CloseCodeAuthzLevel
LookupPrivilegeValueA
QueryUsersOnEncryptedFile
AdjustTokenPrivileges
EnumServicesStatusA
RegQueryValueExA
MakeAbsoluteSD2
CloseServiceHandle
OpenSCManagerA

ntdll

RtlFreeUnicodeString
tolower
memcpy
strstr
memset
RtlAnsiStringToUnicodeString
ZwLoadDriver
strncmp
sprintf
NtQueryObject
isspace
strlen
wcsstr
RtlInitAnsiString
_chkstk
isdigit
NtQuerySystemInformation
vsprintf

psapi

GetProcessImageFileNameA
EnumProcesses

ws2_32

WSASetServiceA
ntohl
select
select
__WSAFDIsSet
inet_ntoa
closesocket
connect
WSAStartup
socket
gethostbyname
htonl
WSACreateEvent
send
htons
recv

ole32

CoCreateGuid

user32

CharLowerW
ExitWindowsEx
SetWindowRgn

Sections

.data
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 512B - Virtual size: 398B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2ca60fc2ce872245e4281dd3fb8ddbdf

Headers

File Characteristics

Imports

shell32

kernel32

advapi32

ntdll

psapi

ws2_32

ole32

user32

Sections

.data Size: 20KB - Virtual size: 20KB

.text Size: 512B - Virtual size: 398B

.idata Size: 3KB - Virtual size: 2KB

.data
Size: 20KB - Virtual size: 20KB

.text
Size: 512B - Virtual size: 398B

.idata
Size: 3KB - Virtual size: 2KB