af5cf7826170a635e47027d79586a3d7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

af5cf7826170a635e47027d79586a3d7_JaffaCakes118
Size

200KB
MD5

af5cf7826170a635e47027d79586a3d7
SHA1

a25a47339db8fbde57aa024aee5cacee0641e599
SHA256

22034634fa7d321223524da8e4b4d2f4b06050dcb6a2fbe912ef518c52953007
SHA512

8a35f83de5fb0a4e0f83fdace64bbe3cd10db94ec7f91a7ca4d7117f56a2bfa3f99607c7a08384dfe851128581b76ef5d743d6cd775a702bac4cde6f687330dd
SSDEEP

3072:V0N9g8d3l2PIcpZPpeOsp92sKe486wAwtB39q2Z6CrMUWh4//eJ9G:Sj712PI8h8v/KetPtq3CpWXJw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af5cf7826170a635e47027d79586a3d7_JaffaCakes118

Files

af5cf7826170a635e47027d79586a3d7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9147449d0cbf218de32f4c02ab9c2cbd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetWindowsDirectoryW
GetSystemTime
QueryPerformanceCounter
GetLocalTime
MoveFileExA
CreateFileW
GetModuleHandleA
GetDateFormatA
FindResourceA
LoadLibraryW
ExitProcess
GetCurrentProcessId
GetFileTime
GetModuleFileNameW
GetProfileStringW
VirtualFree
VirtualAlloc
GetOEMCP
GetACP
CompareStringW
CompareStringA
GetCPInfo
LCMapStringW
LCMapStringA
ReadFile
SetEndOfFile
LoadLibraryA
CreateFileA
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
GetModuleFileNameA
RtlUnwind
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetCommandLineA
GetCommandLineW
GetEnvironmentStrings
GetEnvironmentStringsW
FreeEnvironmentStringsW
MultiByteToWideChar
GetTimeZoneInformation
TerminateProcess
GetCurrentProcess
HeapFree
HeapAlloc
GetStartupInfoW
GetVersion
GetLastError
CloseHandle
WriteFile
SetFilePointer
HeapDestroy
HeapCreate
HeapReAlloc
IsBadWritePtr
WideCharToMultiByte
GetProcAddress
UnhandledExceptionFilter
FreeEnvironmentStringsA
SetEnvironmentVariableA

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

shlwapi

StrStrIW
SHCreateStreamOnFileW
PathCanonicalizeW
PathStripToRootW
PathIsRootW
StrCmpIW

ws2_32

WSASocketW
WSAGetOverlappedResult
WSAConnect
WSACreateEvent
WSACloseEvent
WSAWaitForMultipleEvents

wininet

InternetOpenA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetReadFile
InternetConnectA
InternetSetOptionA
InternetCloseHandle

Sections

.text
Size: 108KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 403KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9147449d0cbf218de32f4c02ab9c2cbd

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

winspool.drv

shlwapi

ws2_32

wininet

Sections

.text Size: 108KB - Virtual size: 105KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 76KB - Virtual size: 403KB

.rsrc Size: 4KB - Virtual size: 856B

.text
Size: 108KB - Virtual size: 105KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 76KB - Virtual size: 403KB

.rsrc
Size: 4KB - Virtual size: 856B