dc8f789b84a112ba29c2a7f063fa0f64_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

dc8f789b84a112ba29c2a7f063fa0f64_JaffaCakes118
Size

5.1MB
MD5

dc8f789b84a112ba29c2a7f063fa0f64
SHA1

4490951d8299deb35b177f5296e51d57f6fe7d05
SHA256

c70db624eb5396c595bc718a594d9f7a5b8a59c7eef4bdfecf57c886496aeff5
SHA512

a02c5a7f82c1fc77722756bf9f912e041e7d8184848fd47cb8913ca9b323b6bfd7d85299c997eead7c4be85f520ababdc42fa95e8d6198c3046918972db0e1eb
SSDEEP

98304:x+o/YWTPcDZiutWpMlXRaFG1s3OJ9N0ggkr7a2Fud5IqXP11aOj0/OpczL:x+MYWTEDZiuUpORaFAs3OJ9C/W7amo5Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dc8f789b84a112ba29c2a7f063fa0f64_JaffaCakes118

Files

dc8f789b84a112ba29c2a7f063fa0f64_JaffaCakes118
.exe windows:5 windows x86 arch:x86

19fc85d6ea72506edaee86750a0d64f5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

AdjustTokenPrivileges

kernel32

GetVersion
GetVersionExA
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

netapi32

NetApiBufferFree

version

GetFileVersionInfoSizeW

winspool.drv

ClosePrinter

comctl32

FlatSB_GetScrollInfo

gdi32

AbortDoc

shell32

ShellExecuteW

shfolder

SHGetFolderPathA

user32

ActivateKeyboardLayout
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

ole32

CoCreateInstance

oleaut32

GetErrorInfo

shlwapi

PathFileExistsA

iphlpapi

GetAdaptersInfo

winhttp

WinHttpAddRequestHeaders

wtsapi32

WTSEnumerateProcessesW
WTSSendMessageW

urlmon

URLDownloadToFileW

Exports

Exports

TMethodImplementationIntercept
__GetExceptDLLinfo
___CPPdebugHook
dbkFCallWrapperAddr

Sections

.text
Size: - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.IdwhIaE
Size: - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.IdwhIaE
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 86KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

19fc85d6ea72506edaee86750a0d64f5

Headers

File Characteristics

Imports

advapi32

kernel32

netapi32

version

winspool.drv

comctl32

gdi32

shell32

shfolder

user32

ole32

oleaut32

shlwapi

iphlpapi

winhttp

wtsapi32

urlmon

Exports

Exports

Sections

.text Size: - Virtual size: 4.1MB

.data Size: - Virtual size: 256KB

.tls Size: - Virtual size: 4KB

.rdata Size: - Virtual size: 4KB

.idata Size: - Virtual size: 16KB

.didata Size: - Virtual size: 4KB

.edata Size: - Virtual size: 4KB

.IdwhIaE Size: - Virtual size: 2.2MB

.IdwhIaE Size: 5.1MB - Virtual size: 5.1MB

.rsrc Size: 86KB - Virtual size: 175KB

.text
Size: - Virtual size: 4.1MB

.data
Size: - Virtual size: 256KB

.tls
Size: - Virtual size: 4KB

.rdata
Size: - Virtual size: 4KB

.idata
Size: - Virtual size: 16KB

.didata
Size: - Virtual size: 4KB

.edata
Size: - Virtual size: 4KB

.IdwhIaE
Size: - Virtual size: 2.2MB

.IdwhIaE
Size: 5.1MB - Virtual size: 5.1MB

.rsrc
Size: 86KB - Virtual size: 175KB