df5602e8440afab272303a1545656f71_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

df5602e8440afab272303a1545656f71_JaffaCakes118
Size

177KB
MD5

df5602e8440afab272303a1545656f71
SHA1

ea2f137f511541de04aa855d1221ecbc4641431d
SHA256

69c472911506bb05f89e4ee3530b4c06e13aadb019be1c19e055240bd738d186
SHA512

34b4ff179258cc95194b9e8a4b5e5cfb7823e77c2c6c6dfcaaa8743a248580e419ad3d0d8d1bd79113fa39eeb436d53c6985d620723e6067dab39467b483d483
SSDEEP

3072:8yu9+S+9PPeOnEMDSc9YuHoetHbdNf1RSU4:dqnOEaHfdNfB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df5602e8440afab272303a1545656f71_JaffaCakes118

Files

df5602e8440afab272303a1545656f71_JaffaCakes118
.exe windows:5 windows x86 arch:x86

8d022f65eb011403eb54b8d581e31be6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegEnumValueA
RegEnumKeyA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey

gdi32

DeleteObject
CreateFontIndirectA
CreateBrushIndirect
GetDeviceCaps
SelectObject
SetBkMode
SetTextColor
SetBkColor

comctl32

ImageList_AddMasked
ImageList_Create
ImageList_Destroy
ord17

kernel32

LocalAlloc
AllocateUserPhysicalPages
lstrlenA
lstrcpynA
lstrcmpiA
lstrcmpA
lstrcatA
WritePrivateProfileStringA
WriteFile
WaitForSingleObject
Sleep
SetFileTime
SetFilePointer
SetFileAttributesA
SetErrorMode
SetCurrentDirectoryA
SearchPathA
RemoveDirectoryA
ReadFile
MultiByteToWideChar
GetSystemDirectoryA
GetShortPathNameA
GetProcAddress
GetPrivateProfileStringA
GetModuleHandleA
GetModuleFileNameA
GetLastError
GetFullPathNameA
GetFileSize
GetFileAttributesA
GetExitCodeProcess
GetDiskFreeSpaceA
GetCurrentProcess
GetCommandLineA
FreeLibrary
FindNextFileA
FindFirstFileA
FindClose
ExpandEnvironmentStringsA
ExitProcess
DeleteFileA
CreateThread
CreateProcessA
CreateFileA
CreateDirectoryA
CopyFileA
CompareFileTime
CloseHandle
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

Sections

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8d022f65eb011403eb54b8d581e31be6

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

gdi32

comctl32

kernel32

Sections

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 70KB - Virtual size: 69KB

.tls Size: 83KB - Virtual size: 83KB

.rsrc Size: 14KB - Virtual size: 14KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 70KB - Virtual size: 69KB

.tls
Size: 83KB - Virtual size: 83KB

.rsrc
Size: 14KB - Virtual size: 14KB