b2c46551c3cd511806c040d4b03ba35a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b2c46551c3cd511806c040d4b03ba35a_JaffaCakes118
Size

2.8MB
MD5

b2c46551c3cd511806c040d4b03ba35a
SHA1

e20fefa0bf3f9185c381ccd294656e1570311685
SHA256

59bc7856fa4cb692613f2726a57e06376d5c5eda1d670f77496c4dbea79e78cd
SHA512

20303971df4d2517b2b55f89e0903192cec5a0834568f95f983eafaa4eacb33b0f7178a710bdeaa5ee2beca581c4c7af83ee04d68babb4fdd45f945c88f9a767
SSDEEP

49152:/cNtF8RVMn6jX85keJFrecSq+OcVOVriOldZ3Cq/2uPcjYoAavO+D:kzWq6jde7reDq+OcVOVdldZyq/NFoXvn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b2c46551c3cd511806c040d4b03ba35a_JaffaCakes118

Files

b2c46551c3cd511806c040d4b03ba35a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

818acc8541d0ab475362b95f869f0024

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtCancelTimer
wcsstr
NtWriteFileGather
RtlNewSecurityObject
wcslen
NtClose
NtOpenFile
RtlCutoverTimeToSystemTime
ZwClose
_wcslwr

mtxclu

MtxCluGetComputerNameW
MtxCluGetDTCVirtualServerNameW
MtxCluGetDTCStatusW
MtxCluIsClusterPresentExW
MtxCluIsClusterPresent
MtxCluIsSameNodeW
MtxCluBringOnlineDTCW

usp10

ScriptGetFontProperties
ScriptStringFree
ScriptStringAnalyse
ScriptGetProperties
ScriptStringGetLogicalWidths
LpkPresent
ScriptIsComplex
UspAllocCache
ScriptStringGetOrder
UspFreeMem
ScriptRecordDigitSubstitution

mprapi

MprAdminConnectionEnum
MprAdminInterfaceSetInfo
MprInfoBlockAdd
MprAdminServerDisconnect
MprConfigBufferFree
MprAdminInterfaceDisconnect
MprAdminInterfaceTransportAdd
MprInfoBlockRemove
MprConfigGetGuidName
MprConfigInterfaceCreate
MprAdminServerConnect
MprAdminUserSetInfo
MprConfigServerConnect
MprConfigInterfaceTransportSetInfo
MprInfoDelete
MprAdminMIBEntryGetNext
MprAdminMIBEntryGet
MprAdminMIBBufferFree
MprAdminInterfaceTransportSetInfo

msvcrt

__p__commode
__p__osver
rand
_fstati64
setbuf
__p__iob
iswspace
__p__fmode
difftime
_access
_mktemp

user32

GetDC
SetForegroundWindow
DdeQueryStringA
VkKeyScanW
GetMenu
GetSystemMetrics
GetFocus
LoadCursorW
SetUserObjectSecurity
OpenInputDesktop
EnumDisplaySettingsW
UpdateLayeredWindow
LoadStringW
GetDesktopWindow
DispatchMessageA
wsprintfA

kernel32

GetCurrentProcess
GetCommMask
GetCurrentProcessId
GetACP
GetFileTime
GetLastError
GlobalGetAtomNameA
GetCurrentThreadId
GetCommandLineW
GetTickCount
Sleep
GetModuleHandleW
ExitProcess
PostQueuedCompletionStatus
GetCommandLineA
GetVersion
GetCurrentThread
GetModuleHandleA
EnumTimeFormatsW
WaitCommEvent
SetConsoleCP
CreateMailslotW
OpenEventA
CreateIoCompletionPort
GetProcessHeap
GetEnvironmentVariableW
VirtualAlloc
GetNamedPipeInfo

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: - Virtual size: 453KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2.9MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

818acc8541d0ab475362b95f869f0024

Headers

File Characteristics

Imports

ntdll

mtxclu

usp10

mprapi

msvcrt

user32

kernel32

Sections

.text Size: 11KB - Virtual size: 10KB

.edata Size: - Virtual size: 453KB

.idata Size: 2.9MB - Virtual size: 5.5MB

.tls Size: - Virtual size: 3KB

DATA Size: 512B - Virtual size: 24B

.rsrc Size: 99KB - Virtual size: 100KB

.text
Size: 11KB - Virtual size: 10KB

.edata
Size: - Virtual size: 453KB

.idata
Size: 2.9MB - Virtual size: 5.5MB

.tls
Size: - Virtual size: 3KB

DATA
Size: 512B - Virtual size: 24B

.rsrc
Size: 99KB - Virtual size: 100KB