bb0c9cd56a66ae582364c42cf5d64045_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

bb0c9cd56a66ae582364c42cf5d64045_JaffaCakes118
Size

290KB
MD5

bb0c9cd56a66ae582364c42cf5d64045
SHA1

f5ea2cfc9c453a9c5df3ddc65ddd74e6d1d75f9d
SHA256

19031b5a81e70ee2e901a020efada80ca2b9a242416b2da75642077313fcfcd8
SHA512

eeeffd9111b3662290e6143b774c07f6c94747aae4150eb806f0fca65e15ce456f65e551b54cbb7e879c50a5e6381834bd9357c9f561d051735202481b283c92
SSDEEP

6144:K71/Yk+J/tvpBZ9+RCszT+uNeq2oTbDkmXCKcf7wea:Kh8J/tvpD96zT+6eqNvXCKc0ea

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bb0c9cd56a66ae582364c42cf5d64045_JaffaCakes118

Files

bb0c9cd56a66ae582364c42cf5d64045_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f3ae9a9b67aaac043d5708975639d10d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryInfoKeyW
GetUserNameA
CryptGenRandom
SetSecurityDescriptorOwner
RegCreateKeyW
RegisterEventSourceW
SetSecurityDescriptorGroup
OpenThreadToken
RegDeleteKeyA
GetSecurityDescriptorDacl
LsaQueryInformationPolicy
SetEntriesInAclW
RegNotifyChangeKeyValue
AddAce
QueryServiceConfigW
RegDeleteValueW
CryptGetHashParam
RegisterTraceGuidsW
RegDeleteKeyW
DuplicateTokenEx
ControlService
CryptAcquireContextW
GetSecurityDescriptorLength
OpenServiceW
CryptAcquireContextA
MakeSelfRelativeSD
EqualSid
LookupAccountSidW
RegCreateKeyA
GetUserNameW
GetTokenInformation
DeleteService
LsaFreeMemory
RegOpenKeyExA
GetSidLengthRequired
RegEnumValueW
RegEnumKeyW
CheckTokenMembership
UnlockServiceDatabase
RegSetValueExW
StartServiceW
OpenSCManagerA
ImpersonateLoggedOnUser
CryptCreateHash
GetTraceLoggerHandle
LookupPrivilegeValueA

kernel32

GetLastError
FlushFileBuffers
IsDebuggerPresent
CompareStringW
GetConsoleMode
GetVersion
lstrcpynW
ReleaseMutex
LoadLibraryExA
WaitForSingleObject
GetCurrentThreadId
GetEnvironmentStrings
CreateMutexA
GetExitCodeThread
ResumeThread
QueryPerformanceCounter
InterlockedIncrement
UnmapViewOfFile
FreeEnvironmentStringsW
VirtualQuery
GetSystemInfo
GetLocaleInfoA
GetCurrentProcess
GetTempPathA
OpenMutexA
GetModuleHandleW
lstrlenW
HeapFree
GetTickCount
HeapReAlloc
TlsGetValue
TerminateProcess
GetThreadLocale
GetFileSize
CreateDirectoryA
GetCommandLineW
GetStartupInfoA
GetSystemTime
DisableThreadLibraryCalls
InitializeCriticalSection
GetSystemDirectoryW
FormatMessageW
GetModuleHandleA
GetStdHandle
GetVersionExW
OpenEventW
CreateMutexW
SetErrorMode
GetCommandLineA
lstrcatA
Sleep
OpenMutexW
PurgeComm
GetFullPathNameW
GetSystemTimeAsFileTime
FindFirstFileW
GetModuleFileNameW
GetCurrentProcessId
SetLastError
VirtualAlloc
LoadResource
WideCharToMultiByte
FindResourceW
RtlUnwind
LCMapStringA
ExitProcess
GetFileAttributesA
VirtualFree
lstrcmpiA

msvcrt

_strdup
_finite
sprintf
_chsize
__setusermatherr
toupper
_rotl
wcsncmp
__pioinfo
_rotr
_tell
_local_unwind2
setlocale
fwrite
memmove
_wfopen
fopen
_cexit
_ftol
towlower
_c_exit
qsort
_adjust_fdiv
memset
__p__osver
rand
exit
??3@YAXPAX@Z
iswspace
_lock
srand
_ltoa
ceil
strncmp
_strlwr
_wcsnicmp
printf
_initterm
__p__iob
malloc
_ultow

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.textbss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.textbss
Size: 275KB - Virtual size: 278KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f3ae9a9b67aaac043d5708975639d10d

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

Sections

.text Size: 4KB - Virtual size: 4KB

.textbss Size: - Virtual size: 2KB

BSS Size: - Virtual size: 3KB

.bss Size: - Virtual size: 1KB

.bss Size: - Virtual size: 1KB

DATA Size: - Virtual size: 220KB

.textbss Size: 275KB - Virtual size: 278KB

.rsrc Size: 10KB - Virtual size: 10KB

.text
Size: 4KB - Virtual size: 4KB

.textbss
Size: - Virtual size: 2KB

BSS
Size: - Virtual size: 3KB

.bss
Size: - Virtual size: 1KB

.bss
Size: - Virtual size: 1KB

DATA
Size: - Virtual size: 220KB

.textbss
Size: 275KB - Virtual size: 278KB

.rsrc
Size: 10KB - Virtual size: 10KB