d29644f4e04781d5dfe1c573a983a16b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d29644f4e04781d5dfe1c573a983a16b_JaffaCakes118
Size

159KB
MD5

d29644f4e04781d5dfe1c573a983a16b
SHA1

9c8969d6d546743c05cef35591571637c6a47a30
SHA256

a672d1fc6eb84420196cac2275cee24e29ad7c60ba59b982d0891074652e4fbe
SHA512

405f4400938377fafb9a972afa58eef27694475e45e890eff608e02c1a6b91d1ef308ef8eb61f6780246040c13907f064432fc15cde4ce68b85448866a9b9ca8
SSDEEP

3072:LNeox6mTI7eWBbQ1CAqWaMmRY3ji1YasoJC5262gCO3sDhPPFJRAhPiEABU:Qxq0eNCAqGmRYTiihB0JZDeP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d29644f4e04781d5dfe1c573a983a16b_JaffaCakes118

Files

d29644f4e04781d5dfe1c573a983a16b_JaffaCakes118
.exe windows:10 windows x86 arch:x86

b1f767050ca9603980e926ab0ec78178

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

msvcrt

exit

ntdll

RtlCreateAcl

api-ms-win-core-synch-l1-1-0

SetEvent

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-security-base-l1-1-0

AddAce

api-ms-win-core-errorhandling-l1-1-0

GetLastError

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

TlsFree

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-heap-l1-1-0

HeapFree

api-ms-win-core-registry-l1-1-0

RegCloseKey

api-ms-win-eventing-provider-l1-1-0

EventWrite

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-memory-l1-1-0

MapViewOfFile

api-ms-win-core-sysinfo-l1-1-0

GetTickCount

api-ms-win-core-localization-l1-2-0

LCMapStringW

api-ms-win-core-threadpool-legacy-l1-1-0

ChangeTimerQueueTimer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

fastprox

?New@CWbemCallSecurity@@SGPAV1@XZ

ncobjapi

WmiDestroyObject

wbemcomn

GetMemLogObject

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.MPRESS1
Size: 90KB - Virtual size: 420KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b1f767050ca9603980e926ab0ec78178

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

ntdll

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-apiquery-l1-1-0

fastprox

ncobjapi

wbemcomn

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.MPRESS1 Size: 90KB - Virtual size: 420KB

.MPRESS2 Size: 5KB - Virtual size: 4KB

.rsrc Size: 63KB - Virtual size: 62KB

.MPRESS1
Size: 90KB - Virtual size: 420KB

.MPRESS2
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 63KB - Virtual size: 62KB