b8c17aa51a7395c08bc8388fbfaf1cc6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b8c17aa51a7395c08bc8388fbfaf1cc6_JaffaCakes118
Size

1.2MB
MD5

b8c17aa51a7395c08bc8388fbfaf1cc6
SHA1

ebb512ddd773fa0c42c75b52b90a9af19ad79102
SHA256

46f3cc9b4a39a3a8086003a7c871a8ad6a8782102a8685ae5b5482c981edb59f
SHA512

9bbf54c4b80a0d5e45e934f03f5e9917ab6141da7377a689e1a78978a0b9e2d6e362c6289acd2438f0ec55453a868b5b2e3556163f8e2f63bbfb689417f922eb
SSDEEP

24576:bwMZxIUnI1xeaefaJtyWkur/RTNFnY1VPPIaDVaHa4dtOLI:fZx/ILbJF/5nY1JPIsIVtO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b8c17aa51a7395c08bc8388fbfaf1cc6_JaffaCakes118

Files

b8c17aa51a7395c08bc8388fbfaf1cc6_JaffaCakes118
.exe windows:3 windows x86 arch:x86

9d822ecc97d4839219ce06baf388f161

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

gdi32

Polygon
CombineRgn
Rectangle
PatBlt

msvcrt

fwrite
_mbslen
_snwprintf
__setusermatherr
ftell
fclose
_wcsdup
_wcmdln
free
_getpid
wcscmp
isspace
wprintf
_local_unwind2
_vsnwprintf
_filelength
__p__commode
__dllonexit
_cexit
_wcslwr
_initterm
__set_app_type
wcsncat
_ftol
_wcsrev
_except_handler3
fseek
wcsncpy
wcstok
wcsrchr
wcspbrk

syssetup

AsrFreeContext
AsrRestorePlugPlayRegistryData

netapi32

NetServerEnum

advapi32

CheckTokenMembership
AllocateAndInitializeSid
InitializeSecurityDescriptor
RegFlushKey
QueryServiceStatus
SetSecurityDescriptorDacl
WriteEncryptedFileRaw
ReadEncryptedFileRaw

kernel32

GetProcessHeap
GetCurrentProcessId
LeaveCriticalSection
ReleaseMutex
VerSetConditionMask
DeviceIoControl
ReadFile
WriteTapemark
GetCurrentThreadId
GetFileInformationByHandle
GetUserDefaultLCID
LocalFileTimeToFileTime
CreateMutexA
SystemTimeToTzSpecificLocalTime
BackupWrite
GetCurrentDirectoryA
GetExitCodeThread
GetTapePosition
EnterCriticalSection
GetProcAddress
VirtualAlloc
GetVersion
OpenMutexA
SetUnhandledExceptionFilter
HeapFree
QueryPerformanceCounter
GetLastError
CloseHandle
InitializeCriticalSection
MultiByteToWideChar
WriteFile
EraseTape
GetFileSize
HeapQueryInformation
GetCurrentProcess

ntdll

NtSetQuotaInformationFile
_aulldvrm
NtQueryQuotaInformationFile
wcscspn

user32

CopyRect
TranslateMessage
CreateWindowExA
LockSetForegroundWindow
ClientToScreen
UnhookWindowsHookEx
DispatchMessageA
GetFocus
RegisterClassExA
GetKeyState
IsWindowVisible
EnableMenuItem
DefWindowProcA
ShowWindow
GetActiveWindow
GetNextDlgGroupItem
UpdateWindow
ChildWindowFromPoint
ExitWindowsEx
IsIconic
GetClientRect
SetCursor
DestroyWindow
GetMessageA
SendMessageA

ole32

CoCreateInstance
CoInitializeEx
CLSIDFromString

shell32

SHGetSpecialFolderLocation

comctl32

ImageList_AddMasked
ImageList_GetImageCount
DestroyPropertySheetPage
ImageList_ReplaceIcon

Sections

.text
Size: 680KB - Virtual size: 680KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 416KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 106KB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9d822ecc97d4839219ce06baf388f161

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

msvcrt

syssetup

netapi32

advapi32

kernel32

ntdll

user32

ole32

shell32

comctl32

Sections

.text Size: 680KB - Virtual size: 680KB

.data Size: 416KB - Virtual size: 416KB

.rsrc Size: 106KB - Virtual size: 3.2MB

.text
Size: 680KB - Virtual size: 680KB

.data
Size: 416KB - Virtual size: 416KB

.rsrc
Size: 106KB - Virtual size: 3.2MB