ade3298e63ffd44331d61e65e2eaf2ed_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ade3298e63ffd44331d61e65e2eaf2ed_JaffaCakes118
Size

1.2MB
MD5

ade3298e63ffd44331d61e65e2eaf2ed
SHA1

cac790bb6f4d3d628a56efd51d8d82dc709591c5
SHA256

ce1b2292ca25fee5b43974d8294adb2b679c2161d826d6053fe2b76f951c62b0
SHA512

1be66607716f8cf35b675a0534c57c9a53e4230f69e7cd72a3ac16ab66f727775f508be3f96d46f91c4cdf12e97e6d4359e6dd239593d0bd3240dd1c6b382b1a
SSDEEP

12288:o62DeGhGp8idKy7CdUDQFwaX9stitPm31vT4NMz1jBU9DpoCnU:nYeGc8i/7eUQ3utAeFb4iJeoCn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ade3298e63ffd44331d61e65e2eaf2ed_JaffaCakes118

Files

ade3298e63ffd44331d61e65e2eaf2ed_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b714e698fb14d25b4d46d52f38d9a158

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ExitProcess
CreateFileA
MoveFileWithProgressA
FillConsoleOutputCharacterA
ReadConsoleInputA
EnumCalendarInfoExA
HeapFree
GetProcessHeap
HeapAlloc
ExitThread
Beep

user32

LoadStringW
ExitWindowsEx
MessageBeep
GetSystemMetrics
BroadcastSystemMessageA
GetCursorPos
GetMessageTime

advapi32

RegDeleteValueW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextW
OpenProcessToken
GetTokenInformation
RegSetValueExW
AllocateAndInitializeSid
LookupAccountSidW
FreeSid
OpenThreadToken
SetThreadToken
RevertToSelf
RegQueryInfoKeyW
RegQueryValueExW
RegNotifyChangeKeyValue
RegOpenKeyExW
CloseServiceHandle
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
RegOpenKeyW
RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
CryptSetProvParam
CryptGetProvParam
CryptReleaseContext
RegConnectRegistryW

rpcrt4

RpcImpersonateClient
RpcServerInqDefaultPrincNameW
RpcServerRegisterAuthInfoW
RpcServerRegisterIfEx
RpcBindingToStringBindingW
RpcServerListen
RpcStringFreeW
I_RpcBindingIsClientLocal
RpcStringBindingParseW
RpcServerRegisterIf
NdrServerCall2
RpcRaiseException
I_RpcBindingInqLocalClientPID
RpcServerUseProtseqEpW
RpcRevertToSelf

Exports

Exports

rzmcbdpti

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b714e698fb14d25b4d46d52f38d9a158

Headers

File Characteristics

Imports

kernel32

user32

advapi32

rpcrt4

Exports

Exports

Sections

.text Size: 14KB - Virtual size: 13KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 1.2MB - Virtual size: 1.2MB

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 14KB - Virtual size: 13KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1.2MB - Virtual size: 1.2MB

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 2KB - Virtual size: 2KB