cf95b69e9d85972683fcf505bb29bb20_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

cf95b69e9d85972683fcf505bb29bb20_JaffaCakes118
Size

337KB
MD5

cf95b69e9d85972683fcf505bb29bb20
SHA1

3a557e3fbf294e3881f22b729ef8fae81ebbd65a
SHA256

a6275d177be7f56f227ba344fcaed20c023cd54b87b7d6b7ccad2e5e74a6ae8d
SHA512

4ae552ae9c7c20b88dbe0b04253e10073b5fc82f37df8ac8c3937722338c45df0f03855779f4f392286a27d729a0504aa0f4265362ba8700b5d5612205721738
SSDEEP

6144:E5eFOlehouxSlEAlI1GUNNm06xQ8m4WoFOY3e1m:E3leeuxSlEAVWE0KjWowj1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf95b69e9d85972683fcf505bb29bb20_JaffaCakes118

Files

cf95b69e9d85972683fcf505bb29bb20_JaffaCakes118
.exe windows:5 windows x86 arch:x86

236d1ab449bb74e9daed69c8c84bd12b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\$ib9\RSI_View\Build\Win32\Unicode\Release\PDB\HMITagsSCM.pdb

Imports

rsgerr

ord31

rsgtmr

TMR_Timer_Set
TMR_Timer_Kill

rsgfil

ord40
ord90
ord91

hmitagssys

ord72
ord70
ord74
ord52
ord40
ord81
ord83
ord76
ord82
ord80
ord84
ord43
ord50
ord51
ord71
ord86
ord73

hmitagstgm

ord204
ord203
ord202
ord215
ord205

hmitagsutl

ord23

kernel32

EnterCriticalSection
LeaveCriticalSection
GetTickCount
InitializeCriticalSection
DeleteCriticalSection
OutputDebugStringW
lstrlenW
ReleaseSemaphore
CloseHandle
CreateSemaphoreW
GlobalMemoryStatus
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
GetSystemDefaultLCID
lstrcpyW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
InitializeCriticalSectionAndSpinCount
LoadLibraryA
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
GetConsoleMode
GetConsoleCP
SetFilePointer
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetModuleFileNameW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetLongPathNameW
RtlUnwind
GetLastError
MultiByteToWideChar
WideCharToMultiByte
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
HeapSize
ExitProcess
FatalAppExitA
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
HeapDestroy
WriteFile
GetStdHandle
GetModuleFileNameA
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA

user32

DefWindowProcW
UnregisterClassW
TranslateMessage
DispatchMessageW
wsprintfW
CreateWindowExW
RegisterClassW
RegisterWindowMessageW
CharUpperW
DestroyWindow
PostQuitMessage
GetMessageW

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

Sections

.rna
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PACK
Size: 164KB - Virtual size: 424KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

236d1ab449bb74e9daed69c8c84bd12b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

rsgerr

rsgtmr

rsgfil

hmitagssys

hmitagstgm

hmitagsutl

kernel32

user32

advapi32

Sections

.rna Size: 7KB - Virtual size: 6KB

.text Size: 139KB - Virtual size: 139KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 4KB - Virtual size: 15KB

.rsrc Size: 2KB - Virtual size: 1KB

PACK Size: 164KB - Virtual size: 424KB

.rna
Size: 7KB - Virtual size: 6KB

.text
Size: 139KB - Virtual size: 139KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 4KB - Virtual size: 15KB

.rsrc
Size: 2KB - Virtual size: 1KB

PACK
Size: 164KB - Virtual size: 424KB