db16f62cfb22b2830222105ddc33640e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

db16f62cfb22b2830222105ddc33640e_JaffaCakes118
Size

192KB
MD5

db16f62cfb22b2830222105ddc33640e
SHA1

bfcff64f4d2f79debb808091591b1751b2983318
SHA256

c37c56751813fc1053b01fc6cb463ebbbd2cc1b84de29e695694f4d1fe816214
SHA512

f40ed9b7ae3541a4a6550ba05bca0c0b1fb3115687a4559998bc59c0c4a08596185b7dd833abd34376ccd31d4da2f0cd5429d2966bf21bba0da2f2201df404f5
SSDEEP

3072:mmxzla8ad6+9A3TJqbgniD2fHm9ALoaJ4ABCorvt5uE2feV+OZkOVf/W36+VwseR:mmxzVad6+wT7nssQsyo2SV+im3zVJitT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
db16f62cfb22b2830222105ddc33640e_JaffaCakes118

Files

db16f62cfb22b2830222105ddc33640e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

49b87c2935e5117b66473cb6808f6f25

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoCreateInstance
CLSIDFromString
CoInitialize
OleInitialize
OleSetContainedObject

advapi32

SetServiceStatus
GetUserNameA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
AllocateAndInitializeSid
RegDeleteKeyA
RegCreateKeyExA
QueryServiceStatus
OpenThreadToken
OpenServiceA
OpenSCManagerA
LookupPrivilegeValueA
CreateServiceW
ControlService
SetSecurityDescriptorDacl
SetEntriesInAclA
RegisterServiceCtrlHandlerA
RegSetValueExA
RegEnumKeyA
InitializeSecurityDescriptor
StartServiceCtrlDispatcherA
OpenProcessToken
FreeSid

usp10

ScriptGetLogicalWidths
ScriptIsComplex
ScriptGetProperties
ScriptGetGlyphABCWidth
ScriptBreak
ScriptApplyLogicalWidth
ScriptItemize

winfax

FaxSendDocumentA
FaxGetDeviceStatusA
FaxEnumRoutingMethodsA
FaxSetConfigurationA
FaxSetGlobalRoutingInfoA

kernel32

GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetCommandLineA
GetTimeZoneInformation
LCMapStringW
LCMapStringA
SetConsoleCtrlHandler
GetStringTypeW
GetStringTypeA
ReadFile
SetStdHandle
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
IsBadCodePtr
IsBadReadPtr
GetVersionExA
FindClose
FindNextFileA
FindFirstFileA
TlsAlloc
GetProfileStringW
lstrcmpA
EnterCriticalSection
Sleep
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
RtlUnwind
GetModuleHandleA
GetStartupInfoA
GetVersion
ExitProcess
RaiseException
HeapFree
FatalAppExitA
TerminateProcess
GetCurrentProcess
HeapReAlloc
HeapAlloc
HeapSize
GetCurrentThreadId
TlsSetValue
TlsFree
SetLastError
TlsGetValue
GetLastError
GetCurrentThread
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
WriteFile
SetFilePointer
FlushFileBuffers
CloseHandle
SetUnhandledExceptionFilter
VirtualAlloc
IsBadWritePtr
GetCPInfo
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID

Exports

Exports

Vobok

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 769KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

49b87c2935e5117b66473cb6808f6f25

Headers

File Characteristics

Imports

ole32

advapi32

usp10

winfax

kernel32

Exports

Exports

Sections

.text Size: 68KB - Virtual size: 67KB

.rdata Size: 36KB - Virtual size: 32KB

.data Size: 76KB - Virtual size: 769KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 68KB - Virtual size: 67KB

.rdata
Size: 36KB - Virtual size: 32KB

.data
Size: 76KB - Virtual size: 769KB

.reloc
Size: 8KB - Virtual size: 6KB