b52ff3facad18874ff4150c8cc597f57_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b52ff3facad18874ff4150c8cc597f57_JaffaCakes118
Size

84KB
MD5

b52ff3facad18874ff4150c8cc597f57
SHA1

6a8f4ac7e6c831ba8c874e66a1f537cc0ba8c5bd
SHA256

4329416b596a83c937d0568668a53c8da8e2cf4267df1bb77663dbfa0b8657ea
SHA512

cdac140925cee9842a52829cc02c01bc32ba1203100f72a8066eca7be80eb499a0cb6022c6e84800ae81e26558a7dfd512b93814ddb85a650f41981abd2c084f
SSDEEP

1536:ms138FasboRlOyVrq27bcjkx+6mNMp3ZYNLPIud6iYERkpZ3TlTR9UY:hscRN17bcjkx+6mNMppY121oY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b52ff3facad18874ff4150c8cc597f57_JaffaCakes118

Files

b52ff3facad18874ff4150c8cc597f57_JaffaCakes118
.exe windows:5 windows x86 arch:x86

d163543224bbda9efe635cf3057f4478

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetShortPathNameW
HeapCreate
GetStartupInfoA
LoadLibraryA
HeapQueryInformation
GetCurrentProcessId
FlushViewOfFile
ReadFileEx
BaseCheckAppcompatCache
GetLastError
ExitThread
FindFirstFileExW
FindNextFileW
QueryPerformanceCounter
GetSystemTimeAsFileTime
PulseEvent
GetCurrentThreadId
VirtualAlloc
GetTickCount
RemoveLocalAlternateComputerNameW
SetConsoleMode

setupapi

SetupDiInstallDevice
CM_Invert_Range_List
SetupGetLineByIndexA
CM_Set_DevNode_Registry_PropertyW
ExtensionPropSheetPageProc
pSetupUnicodeToMultiByte
SetupOpenFileQueue
SetupGetFileCompressionInfoW
SetupGetSourceFileSizeA
SetupDiDeleteDeviceInterfaceRegKey
CM_Open_Class_Key_ExW
SetupInstallFileExA
SetupDiGetClassImageList
CM_Get_First_Log_Conf
CM_Add_IDA
CM_Get_Device_ID_List_SizeW

advapi32

LockServiceDatabase
SystemFunction030
InitializeSecurityDescriptor
ElfDeregisterEventSource
MSChapSrvChangePassword2
LsaRetrievePrivateData
WmiDevInstToInstanceNameW
ElfClearEventLogFileW
CreatePrivateObjectSecurityWithMultipleInheritance
ElfOpenBackupEventLogW
BuildTrusteeWithObjectsAndNameW

rpcrt4

RpcServerInqIf
RpcSmDestroyClientContext
RpcServerUseProtseqExW
IUnknown_AddRef_Proxy
NdrUserMarshalMemorySize
RpcServerUseProtseqEpExA
RpcMgmtSetServerStackSize
data_from_ndr
RpcMgmtStatsVectorFree
enum_from_ndr
NdrServerContextMarshall
I_RpcClearMutex
NDRSContextUnmarshallEx
NdrpGetTypeGenCookie
CStdStubBuffer_DebugServerQueryInterface
NdrConformantVaryingStructMarshall
NdrCorrelationInitialize
NdrRpcSsEnableAllocate
I_RpcConnectionInqSockBuffSize
NdrUserMarshalUnmarshall
IUnknown_QueryInterface_Proxy
RpcMgmtEpEltInqNextA
RpcServerListen

ntdll

RtlpNtMakeTemporaryKey
RtlZeroMemory
RtlActivateActivationContext
NtOpenTimer
RtlFormatMessage
RtlCreateBootStatusDataFile
ZwLoadKey
NtCreateThread
RtlTraceDatabaseCreate
RtlQueryInformationActivationContext
RtlLookupElementGenericTableAvl
RtlGetElementGenericTable
RtlSetOwnerSecurityDescriptor
RtlGetProcessHeaps
ZwProtectVirtualMemory

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d163543224bbda9efe635cf3057f4478

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

setupapi

advapi32

rpcrt4

ntdll

Sections

.text Size: 34KB - Virtual size: 34KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 16KB - Virtual size: 30KB

.rsrc Size: 19KB - Virtual size: 18KB

.reloc Size: 512B - Virtual size: 312B

.text
Size: 34KB - Virtual size: 34KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 16KB - Virtual size: 30KB

.rsrc
Size: 19KB - Virtual size: 18KB

.reloc
Size: 512B - Virtual size: 312B