ce629fab4bf4a58e147304a05583fdbd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ce629fab4bf4a58e147304a05583fdbd_JaffaCakes118
Size

369KB
MD5

ce629fab4bf4a58e147304a05583fdbd
SHA1

25981fc2a4f371b928713b8d6fc732ff40b96a5a
SHA256

aa9580bfa2727b5254359d892176448464d220515b83c176636ceea0d16e7e6c
SHA512

e561150f54a6cdbc8128bcdf934d78a3f896296cd09eb51762726147870c842b01f242a858a0ad929a57014f8638f5a1590036352cf04e09ca2581fd6192e23a
SSDEEP

6144:fAmDeFhFoRuRysgaACh6MZ6AnTK3sjzBexZYzU5LoRiTWmB7HbyFo:XePRysVZhL0AnosX+zLxSmB778o

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ce629fab4bf4a58e147304a05583fdbd_JaffaCakes118

Files

ce629fab4bf4a58e147304a05583fdbd_JaffaCakes118
.exe windows:4 windows x86 arch:x86

eb86adb213827388264f84ff71d30da6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

LoadIconA
GetWindow
GetDlgItemInt
GetWindowTextLengthA
CascadeWindows
SetDlgItemTextA
DialogBoxParamA
GetDesktopWindow
BeginDeferWindowPos
WindowFromPoint
MessageBoxIndirectA

gdi32

DrawEscape
CreateDCA
EnumObjects
FloodFill
CopyMetaFileW
Escape
CombineTransform
EndPage
CancelDC
CopyMetaFileA
Chord
ExtFloodFill

advapi32

AdjustTokenPrivileges
NotifyChangeEventLog
RegFlushKey
RegOpenKeyA
RegDeleteValueA

kernel32

GetLastError
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
GlobalUnlock
LocalSize
GetNumberFormatA
HeapAlloc
SetLocaleInfoA
IsValidCodePage
HeapUnlock
IsBadStringPtrA
GetThreadLocale
FoldStringA
IsBadWritePtr
VirtualAllocEx
WaitForMultipleObjects
GetOverlappedResult
LCMapStringA
GetPrivateProfileStructA
GetPrivateProfileSectionNamesA
GetProfileIntA
GetProcAddress
GetHandleInformation
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LoadLibraryA
HeapReAlloc
VirtualAlloc
GetOEMCP
GetACP
TlsGetValue
GetCPInfo
SetLastError
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW

winspool.drv

DeletePrinterConnectionA
AddFormA
GetJobA
EnumPrinterDriversA
EnumPrinterDriversW
GetPrinterA
AddPrinterConnectionA
DeletePrinterDriverExW
DeleteFormA

netapi32

NetUseEnum
NetGetJoinInformation
NetConfigGet
NetGroupAddUser
NetFileClose
NetGroupAdd
NetGetDCName
NetErrorLogRead
NetAuditWrite
NetConfigSet
NetErrorLogWrite

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.nkdjuj
Size: 331KB - Virtual size: 330KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eb86adb213827388264f84ff71d30da6

Headers

File Characteristics

Imports

user32

gdi32

advapi32

kernel32

winspool.drv

netapi32

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 2KB - Virtual size: 81KB

.nkdjuj Size: 331KB - Virtual size: 330KB

.rsrc Size: 3KB - Virtual size: 2KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 2KB - Virtual size: 81KB

.nkdjuj
Size: 331KB - Virtual size: 330KB

.rsrc
Size: 3KB - Virtual size: 2KB