c1eaada68a003598ded18539c9ac21b4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c1eaada68a003598ded18539c9ac21b4_JaffaCakes118
Size

83KB
MD5

c1eaada68a003598ded18539c9ac21b4
SHA1

502d98348156e89eb98d5bd8e44fa2a54f6c844f
SHA256

206b170f0f5f3d72dced0b12d2e706ec8c4d17439c5cec253814ba921848b571
SHA512

9bfb6bd02d7ada064010441bc29da54ceb451d216e02f5796b2e40aebf0f16faf317ab2e44d12dd52aa0012c4412d46b4b1d1f425c9af9d637c069256de7c189
SSDEEP

1536:9k6qSQBcOUg7XoUl7+w8gftvwRDjWefh8agqGsvt1vvRlmg6EBK5hA:q68BcvgtlqrgJwRD6WWy1nrr6EBF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c1eaada68a003598ded18539c9ac21b4_JaffaCakes118

Files

c1eaada68a003598ded18539c9ac21b4_JaffaCakes118
.exe windows:5 windows x86 arch:x86

3b65a59c7975a7324f315ac72ea9f299

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtDisplayString
NtModifyBootEntry
ZwSetLdtEntries
NtOpenProcess
RtlCopySidAndAttributesArray
RtlQueryProcessBackTraceInformation
ZwCompactKeys
RtlIsGenericTableEmptyAvl
RtlNewInstanceSecurityObject
RtlCreateSystemVolumeInformationFolder
RtlCreateTimerQueue
ZwQueryDirectoryFile
ZwQueryDirectoryObject

kernel32

SetCurrentDirectoryW
LocalAlloc
FindActCtxSectionGuid
WritePrivateProfileSectionW
GetConsoleWindow
DebugBreak
VirtualAlloc
LoadLibraryA
IsValidLanguageGroup
GetProcessVersion
_hread
QueryMemoryResourceNotification
WriteFileEx
FindNextChangeNotification
GetSystemWow64DirectoryA
CreateProcessInternalA
GetDateFormatA
GetOverlappedResult

perfctrs

OpenNbfPerformanceData
CloseIPXPerformanceData
OpenSPXPerformanceData
CloseTcpIpPerformanceData
CloseSPXPerformanceData
CollectNWNBPerformanceData
OpenIPXPerformanceData
CloseNbfPerformanceData
CollectTcpIpPerformanceData
CollectDhcpPerformanceData
OpenDhcpPerformanceData
CollectIPXPerformanceData
OpenNWNBPerformanceData
CollectSPXPerformanceData
CloseDhcpPerformanceData
CloseNWNBPerformanceData
CollectNbfPerformanceData

cfgmgr32

CM_Get_Parent
CM_Disable_DevNode
CM_Free_Log_Conf
CM_Query_Arbitrator_Free_Size
CM_Get_Hardware_Profile_Info_ExW
CM_Enumerate_EnumeratorsW
CM_Open_Class_Key_ExA
CM_Modify_Res_Des
CM_Get_First_Log_Conf
CM_Get_Log_Conf_Priority
CM_Unregister_Device_Interface_ExW
CM_Dup_Range_List
CM_Open_Class_KeyA
CM_Get_Class_NameW
CM_Get_Next_Res_Des

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 316B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3b65a59c7975a7324f315ac72ea9f299

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

perfctrs

cfgmgr32

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 24KB - Virtual size: 32KB

.rsrc Size: 19KB - Virtual size: 19KB

.reloc Size: 512B - Virtual size: 316B

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 24KB - Virtual size: 32KB

.rsrc
Size: 19KB - Virtual size: 19KB

.reloc
Size: 512B - Virtual size: 316B