b45c1130428c2951f19832ae0377e8b0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b45c1130428c2951f19832ae0377e8b0_JaffaCakes118
Size

275KB
MD5

b45c1130428c2951f19832ae0377e8b0
SHA1

b60d1c7ad16b4b3c07301f02c4e2564d593f1f32
SHA256

fbb72feeaeb2332e21fee377b494e49a0aaf19d35201b07afe1b5598ed2e9a42
SHA512

24135c5ead208325269fa311e48e302051832b723e14e470bf768b6c538b09b8f16c4705ec7c37bd3ec7f37a54f0a1e012b04c4f79dc980814fe6c4b2b11eb7f
SSDEEP

6144:aGSPTRWLYeB7e/WWc/+R7KpFJPGp7lrg:2RW3B7Ycywu58

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b45c1130428c2951f19832ae0377e8b0_JaffaCakes118

Files

b45c1130428c2951f19832ae0377e8b0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2f2b0549f076eeb96296ccb3ecc3f1a3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

VarBstrCmp
SafeArrayDestroy
SafeArrayCopy
VariantCopyInd
SafeArrayRedim
VariantInit
SafeArrayGetUBound
SafeArrayCreate
VariantClear
VariantCopy
SafeArrayGetVartype
SysStringByteLen
SysFreeString
SafeArrayGetLBound
SysAllocStringLen
GetErrorInfo
SafeArrayUnlock
VariantChangeType
SysAllocString
SysAllocStringByteLen
SafeArrayLock
LoadTypeLi
LoadRegTypeLi
SysStringLen

shlwapi

PathAppendW

kernel32

WideCharToMultiByte
HeapDestroy
WaitForSingleObject
lstrlenW
DeleteCriticalSection
SignalObjectAndWait
LocalFree
CopyFileW
RaiseException
FindResourceW
SetUnhandledExceptionFilter
LeaveCriticalSection
SetThreadLocale
HeapFree
FindResourceExW
LoadResource
CreateThread
GetSystemTimeAsFileTime
CreateEventW
CreateDirectoryW
CreateFileW
FormatMessageW
lstrlenA
UnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
GetACP
GetProcessHeap
SizeofResource
GetCurrentThreadId
HeapReAlloc
LockResource
HeapSize
GetThreadLocale
HeapAlloc
CloseHandle
GetModuleHandleA
VirtualAllocEx
IsBadWritePtr

advapi32

GetSidSubAuthority
InitializeSid
IsValidSid
RegCloseKey
RegQueryValueExW
ConvertStringSidToSidW
RegEnumKeyExW
RegOpenKeyExW
EqualSid
RegisterEventSourceW
OpenProcessToken
DeregisterEventSource
GetSidLengthRequired
ReportEventW
GetTokenInformation
CopySid
GetLengthSid
OpenThreadToken
RegEnumValueW

userenv

UnloadUserProfile
GetAllUsersProfileDirectoryA
RsopAccessCheckByType
DeleteProfileA
GetPreviousFgPolicyRefreshInfo
DllCanUnloadNow

user32

UnregisterClassA

shell32

SHGetFolderPathW

ole32

CoInitializeEx
CLSIDFromProgID
CoCreateInstance
CoUninitialize
CoRevertToSelf
CoImpersonateClient
CLSIDFromString
OleRun

msafd

WSPStartup

Sections

.text
Size: 223KB - Virtual size: 223KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.KiSulqV
Size: 512B - Virtual size: 258B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bLUXlqV
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.oINdDsE
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zDgOpLE
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.GrVYpLE
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qscqprE
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eZOH
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avIBsnE
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.OasEtfj
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tCzPtfj
Size: 1024B - Virtual size: 949B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2f2b0549f076eeb96296ccb3ecc3f1a3

Headers

DLL Characteristics

File Characteristics

Imports

oleaut32

shlwapi

kernel32

advapi32

userenv

user32

shell32

ole32

msafd

Sections

.text Size: 223KB - Virtual size: 223KB

.KiSulqV Size: 512B - Virtual size: 258B

.bLUXlqV Size: 4KB - Virtual size: 3KB

.rdata Size: 3KB - Virtual size: 7KB

.oINdDsE Size: 4KB - Virtual size: 3KB

.zDgOpLE Size: 3KB - Virtual size: 3KB

.GrVYpLE Size: 4KB - Virtual size: 4KB

.qscqprE Size: 2KB - Virtual size: 1KB

.data Size: 8KB - Virtual size: 169KB

.rsrc Size: 11KB - Virtual size: 11KB

.eZOH Size: 2KB - Virtual size: 1KB

.avIBsnE Size: 2KB - Virtual size: 1KB

.OasEtfj Size: 4KB - Virtual size: 4KB

.tCzPtfj Size: 1024B - Virtual size: 949B

.text
Size: 223KB - Virtual size: 223KB

.KiSulqV
Size: 512B - Virtual size: 258B

.bLUXlqV
Size: 4KB - Virtual size: 3KB

.rdata
Size: 3KB - Virtual size: 7KB

.oINdDsE
Size: 4KB - Virtual size: 3KB

.zDgOpLE
Size: 3KB - Virtual size: 3KB

.GrVYpLE
Size: 4KB - Virtual size: 4KB

.qscqprE
Size: 2KB - Virtual size: 1KB

.data
Size: 8KB - Virtual size: 169KB

.rsrc
Size: 11KB - Virtual size: 11KB

.eZOH
Size: 2KB - Virtual size: 1KB

.avIBsnE
Size: 2KB - Virtual size: 1KB

.OasEtfj
Size: 4KB - Virtual size: 4KB

.tCzPtfj
Size: 1024B - Virtual size: 949B