ba29c4e5532de7017b341b9ce07ae9b2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ba29c4e5532de7017b341b9ce07ae9b2_JaffaCakes118
Size

123KB
MD5

ba29c4e5532de7017b341b9ce07ae9b2
SHA1

e4e89efafab7b0a8e9aebaa5838bc30982f23b3b
SHA256

b6c54425374c96ff8e2966394214b549d305a38b3701ee13e3383a6224a823c4
SHA512

4954a2c0321a64ae333f441b00581704691ecc44264f4cd1f422eb4ac1a9cea829b22425d5f6680b954ba99992be313151b9b80839febb8a16560ffc8c5ba2ea
SSDEEP

1536:LiXxkaJgPZlh62O9iQVs29/Cvp/7HLN/7qNehrmMgZ1xSy5GI0SQG7dH0QDlVTY5:zRllO4/Fd/OkbgZ1mI7v9PxSXI52+Cr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ba29c4e5532de7017b341b9ce07ae9b2_JaffaCakes118

Files

ba29c4e5532de7017b341b9ce07ae9b2_JaffaCakes118
.exe windows:5 windows x86 arch:x86

8843b2aed310664d2710b560d95425f2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\SRC\AntiVir\wsctest\WSCTool\Release\WSCTool.pdb

Imports

kernel32

GetPrivateProfileStringW
GetModuleHandleW
GetModuleFileNameW
GetVersionExW
LoadLibraryA
ExpandEnvironmentStringsA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
GetCurrentProcess
LoadLibraryW
GetProcAddress
WriteFile
CreateProcessW
Sleep
GetExitCodeProcess
CreateEventW
WaitForSingleObject
WritePrivateProfileStringW
LoadLibraryExW
FreeLibrary
DeleteFileW
GetLastError
CreateFileW
CloseHandle
GetFileAttributesW
SetFileAttributesW
GetWindowsDirectoryW

advapi32

RegOpenKeyExA
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExA
RegCloseKey

shell32

ShellExecuteW

msvcr90

_invoke_watson
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_except_handler4_common
_wgetcwd
_wchdir
_wsplitpath_s
wcsncmp
iswalnum
iswspace
vswprintf_s
_wfopen_s
fclose
_time64
srand
rand
swprintf_s
wcscat_s
swscanf_s
wcsncpy_s
wcsncat_s
wcsrchr
wcslen
free
wcscat
wcscpy
memset
malloc
wcsncpy
_wtoi
_wcsicmp
wcscpy_s
??3@YAXPAX@Z
_waccess
wcsncat
wcschr
wcsstr
__CxxFrameHandler3
_snwprintf
wcscmp
_controlfp_s

user32

GetForegroundWindow
LoadStringW

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.lrdata
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8843b2aed310664d2710b560d95425f2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shell32

msvcr90

user32

Sections

.text Size: 21KB - Virtual size: 20KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 1KB - Virtual size: 6KB

.rsrc Size: 27KB - Virtual size: 27KB

.lrdata Size: 60KB - Virtual size: 60KB

.text
Size: 21KB - Virtual size: 20KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 1KB - Virtual size: 6KB

.rsrc
Size: 27KB - Virtual size: 27KB

.lrdata
Size: 60KB - Virtual size: 60KB