d74a288e65b18a7c8ae8c27982ec8381_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d74a288e65b18a7c8ae8c27982ec8381_JaffaCakes118
Size

2.7MB
MD5

d74a288e65b18a7c8ae8c27982ec8381
SHA1

6caddd3e1a6169de42bdbc35f2fffcb9a1d15667
SHA256

bc9bb485001334209d463bb3c4dce247b7fa634b6050a9f01bc86dd186e643d7
SHA512

e649388e5e9d74f54d49498603514b696f65525e177a2b1dcd2f8f4d3e7bcaa5701efc7af5f4fcf7d52c1bc631639de221e140470e6e9da7753cd175f727260a
SSDEEP

49152:wPqLH7TW9u9uz+jFJqkQqMbTd85q/FoVdUAe88X:eAbpxJWfTdW3c88X

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d74a288e65b18a7c8ae8c27982ec8381_JaffaCakes118

Files

d74a288e65b18a7c8ae8c27982ec8381_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0727f5da12cd50ba3a482141c94c576a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSACloseEvent
WSAConnect
WSAAddressToStringA
WSACreateEvent
WSAWaitForMultipleEvents
WSAEnumNetworkEvents

userenv

EnterCriticalPolicySection
UnloadUserProfile
DeleteProfileA
CreateEnvironmentBlock
DestroyEnvironmentBlock

winmm

waveInClose
timeBeginPeriod
timeEndPeriod
waveInAddBuffer
waveInOpen
waveInStop
waveInStart

mpr

WNetAddConnection2A
WNetGetUniversalNameA
WNetGetUserA

netapi32

NetWkstaGetInfo
NetApiBufferFree
NetGetAnyDCName

comdlg32

GetFileTitleA
ChooseFontA
CommDlgExtendedError
GetSaveFileNameA
GetOpenFileNameA
ChooseColorA

comctl32

ImageList_Remove
ImageList_SetBkColor
ImageList_SetDragCursorImage
ImageList_SetIconSize
ImageList_Write
ImageList_AddMasked
ImageList_GetImageCount
ImageList_Destroy

kernel32

GetACP
GetCPInfo
WriteFile
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
GetOEMCP
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
HeapAlloc
HeapFree
GetCurrentProcess
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
UnhandledExceptionFilter
SetSystemPowerState
GetProcessHeap
GetLocalTime
CreateFileA
WriteConsoleW
VirtualProtect
GetEnvironmentVariableA
lstrcmpiA
ExitProcess
TerminateProcess

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 548KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0727f5da12cd50ba3a482141c94c576a

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

userenv

winmm

mpr

netapi32

comdlg32

comctl32

kernel32

Sections

.text Size: 36KB - Virtual size: 36KB

.rdata Size: 236KB - Virtual size: 236KB

.data Size: 548KB - Virtual size: 2.2MB

.idata Size: 4KB - Virtual size: 4KB

.tls Size: 4KB - Virtual size: 4KB

.rsrc Size: 32KB - Virtual size: 31KB

.text
Size: 36KB - Virtual size: 36KB

.rdata
Size: 236KB - Virtual size: 236KB

.data
Size: 548KB - Virtual size: 2.2MB

.idata
Size: 4KB - Virtual size: 4KB

.tls
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 32KB - Virtual size: 31KB