b8e82d2fe55cdd84e89a2a1775e0da43_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b8e82d2fe55cdd84e89a2a1775e0da43_JaffaCakes118
Size

152KB
MD5

b8e82d2fe55cdd84e89a2a1775e0da43
SHA1

1d2ae8ed6fdd8845324f8a1ec867c32d60d4f279
SHA256

e03c8482242dada7e2f7043e72365b98731bb3636e457f33e9a7a2012dd70097
SHA512

8257fc41b795441acdcf6747e6d4b0ffce37ca46e3774aa3ec74d247b3b3d4932953e3ca5b0d23cedf1258a49df63d6dabebb0eb451c7c711e3e91454f7a62bb
SSDEEP

3072:v6UyITB8ZGws/s7ENBoqpWWCU3yM6/x9vB9q9sAc+TV3UHGag5VORES3:ynIlqLs/sIqqpWWCU3l6P+9tb+HGag2T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b8e82d2fe55cdd84e89a2a1775e0da43_JaffaCakes118

Files

b8e82d2fe55cdd84e89a2a1775e0da43_JaffaCakes118
.exe windows:5 windows x86 arch:x86

0052057d7d1416d78b7088779a2bb424

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemTime
GetCurrentProcessId
EnterCriticalSection
WaitCommEvent
FindClose
DeleteFileA
GetFileAttributesA
CreateFileA
TerminateProcess
CreateProcessA
VirtualQuery
GetVersion
WriteFile
OpenEventA
CreateEventA
ExitProcess
HeapAlloc
SetUnhandledExceptionFilter
CreateThread
DosDateTimeToFileTime
ReadFile
GetCurrentThreadId
LeaveCriticalSection
SetFileAttributesA
SystemTimeToFileTime
HeapFree
LocalFileTimeToFileTime
GetDiskFreeSpaceA
SetLastError
GetProcessHeap
GetDriveTypeA
GetFileSize
MoveFileExA
FindNextFileA
GetSystemDirectoryA
MoveFileA
SetEndOfFile
GetProcAddress
GetExitCodeProcess
DeviceIoControl
GetSystemTimeAsFileTime
SetFileTime
FreeLibrary
QueryDosDeviceA
ExpandEnvironmentStringsA
FindFirstFileA
WideCharToMultiByte
SetErrorMode
lstrcpynA
SetThreadAffinityMask
CloseHandle
GetTickCount
GetCommandLineA
CopyFileA
QueryPerformanceCounter
DeleteCriticalSection
SetFilePointer
SetEvent
Sleep
GetVersionExA
GetModuleHandleA
GetCurrentDirectoryA
SetHandleContext
BackupWrite
RemoveDirectoryA

advapi32

OpenProcessToken
InitiateSystemShutdownA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
CryptGenRandom
CryptAcquireContextA
GetLengthSid
AddAccessAllowedAce
AllocateAndInitializeSid
GetTokenInformation
CryptReleaseContext

user32

SendDlgItemMessageA
SendMessageA
SetParent
LoadStringA
MessageBoxA
DialogBoxParamA
EndDialog
ShowWindow

ntdll

NtShutdownSystem
NtClose
NtOpenProcessToken
NtAdjustPrivilegesToken

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.kltxed
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 133KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0052057d7d1416d78b7088779a2bb424

Headers

File Characteristics

Imports

kernel32

advapi32

user32

ntdll

shell32

Sections

.text Size: 6KB - Virtual size: 5KB

.data Size: 8KB - Virtual size: 14KB

.kltxed Size: 3KB - Virtual size: 3KB

.edata Size: 133KB - Virtual size: 155KB

.text
Size: 6KB - Virtual size: 5KB

.data
Size: 8KB - Virtual size: 14KB

.kltxed
Size: 3KB - Virtual size: 3KB

.edata
Size: 133KB - Virtual size: 155KB