befb9818107b6c85fe57f00f05a9f28b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

befb9818107b6c85fe57f00f05a9f28b_JaffaCakes118
Size

100KB
MD5

befb9818107b6c85fe57f00f05a9f28b
SHA1

7eb261f7c870a35d246e89707769b22993034eea
SHA256

1606d6bd4dcd29b07a5c3606cac788d3afe4714bfff9c7f1cfc78326a34c859c
SHA512

929f82616c44f355847103f5a88e752e890151f801bde16c4f8b9cb6337d6342cbb0658cb47925bdd82df879d22746e9fc62797bc79144396ade9a0324f18d80
SSDEEP

1536:nzCF7aK7UCTTpyMkpSGnQBnDSP7cc/fciMJ4BejC/B0BGf0EsYcWt8eD8qt/RApj:uF7amU6891+SJ/fq4By7G7sYx1D9/xO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
befb9818107b6c85fe57f00f05a9f28b_JaffaCakes118

Files

befb9818107b6c85fe57f00f05a9f28b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ee940f39ab66a6b7703d921f0c0f5dc5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

SetPropA
ReleaseDC
RegisterClassA
GetWindowLongA
GetPropA
GetDoubleClickTime
GetDlgItemTextA
GetDC
GetClientRect
GetCapture
FrameRect
ExitWindowsEx
EnumChildWindows
DrawEdge
CloseClipboard

netapi32

NetDfsManagerSendSiteInfo
NetLocalGroupSetInfo
NetReplExportDirEnum
NetShareDel
NetUserEnum

oleaut32

SysReAllocString
SysStringLen
SafeArrayDestroy
RevokeActiveObject
OleTranslateColor
OleLoadPicture
OleIconToCursor
GetErrorInfo

dbghelp

SymGetModuleBase
SymGetLineFromAddr64
SymEnumerateSymbolsW
FindDebugInfoFileEx

shlwapi

ColorHLSToRGB
PathAddExtensionA
PathFindFileNameW
PathIsUNCServerA
AssocQueryKeyA
ChrCmpIA

advapi32

CreateProcessAsUserW
ElfOpenEventLogA
LookupPrivilegeNameA
LsaClearAuditLog
RegUnLoadKeyW
SetFileSecurityA
SetPrivateObjectSecurity
SetSecurityDescriptorRMControl
SetServiceStatus
AddAuditAccessObjectAce

kernel32

WriteFileEx
SetUnhandledExceptionFilter
SetTapeParameters
SetEvent
HeapCreate
HeapAlloc
GetVolumeInformationA
GetVersionExW
GetVersionExA
GetStartupInfoA
GetModuleHandleA
GetCommandLineA
FoldStringA
FindVolumeMountPointClose
FindFirstVolumeW
CancelTimerQueueTimer
CloseHandle
EnumResourceNamesA
EnumSystemLanguageGroupsW
ExitProcess
AssignProcessToJobObject

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ee940f39ab66a6b7703d921f0c0f5dc5

Headers

File Characteristics

Imports

user32

netapi32

oleaut32

dbghelp

shlwapi

advapi32

kernel32

Sections

.text Size: 60KB - Virtual size: 59KB

.data Size: 28KB - Virtual size: 27KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 60KB - Virtual size: 59KB

.data
Size: 28KB - Virtual size: 27KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 3KB