ebe55ae70d8a8172d33aec920b647440_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

ebe55ae70d8a8172d33aec920b647440_JaffaCakes118
Size

80KB
MD5

ebe55ae70d8a8172d33aec920b647440
SHA1

e1ecbad75e21abe638eda5f594832dd63bddb9db
SHA256

362e1fc22bb7aa86a11578c8e9f324d323d58983d5ae11f65c7f4de7f1a9d56a
SHA512

148bce0f6693804bdecf4b4bfbd755e8c766a15bef330eb4d9b0ecdf72cf87b43663acfb365c47f9e5a8db1cc6e1f34a75cadd87dae750db6a30624348b46838
SSDEEP

1536:2a2XHvYfV10FXGwAc/dNvGh8AwGTCCFEdyLHVB17wdvJNyeKod:27YXmgzPFEdyL17evTy9o

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ebe55ae70d8a8172d33aec920b647440_JaffaCakes118

Files

ebe55ae70d8a8172d33aec920b647440_JaffaCakes118
.dll windows:4 windows x86 arch:x86

a337b728ed3f06b9d1e1e11a55ed0c73

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReadFile
LockResource
GetDateFormatA
EnumResourceLanguagesW
CreateMutexW
WaitForMultipleObjects
VerifyVersionInfoW
SetHandleCount
GetOverlappedResult
CreateActCtxW
GetQueuedCompletionStatus
SetConsoleCtrlHandler
CreatePipe
OpenSemaphoreA
FillConsoleOutputAttribute
GetProfileStringW
RtlMoveMemory
FreeEnvironmentStringsW
IsBadWritePtr
FormatMessageA
GetCurrentProcess
GetVolumePathNameW
GetCommTimeouts
MultiByteToWideChar
SetCommTimeouts
DuplicateHandle
SetVolumeLabelW
GetTimeFormatW
GetCurrentDirectoryW
TerminateThread
OpenMutexA
GetSystemWow64DirectoryW
GetNumberFormatA
GetCurrencyFormatA
DosDateTimeToFileTime
SetFilePointer
GetFileType
GetModuleFileNameW
DeviceIoControl
SuspendThread
MoveFileW
GetExitCodeThread
WaitForSingleObject
CreateProcessA
VirtualProtect
SetLastError
ReleaseMutex
GetVolumeInformationA
InterlockedExchange
CreateDirectoryA
GetModuleFileNameA
InterlockedCompareExchange
GetLastError
UnmapViewOfFile
lstrlenA
GetProcAddress
GetSystemTimeAsFileTime
GetComputerNameA
HeapAlloc
GetProcessHeap
GetCurrentProcessId
LoadLibraryA
InterlockedIncrement
CreateFileMappingA
GetDriveTypeW
InitializeCriticalSectionAndSpinCount

advapi32

GetServiceDisplayNameW
CreateProcessAsUserA
QueryServiceStatus
ChangeServiceConfigA
RegLoadKeyW
QueryServiceStatusEx
SetEntriesInAclW
RegDeleteKeyA
RegisterServiceCtrlHandlerExW
RegSetValueA
ClearEventLogW
CredWriteDomainCredentialsW
BuildExplicitAccessWithNameW
EnumServicesStatusW
LogonUserW
GetTokenInformation
GetUserNameA
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSetValueExA
RegCloseKey
RegCreateKeyExA
RegQueryValueExA
OpenSCManagerA

shell32

ExtractIconExW
SHGetSpecialFolderPathW
ShellExecuteExA
SHAppBarMessage

Exports

Exports

DesktopNetTray

Sections

.text
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a337b728ed3f06b9d1e1e11a55ed0c73

Headers

File Characteristics

Imports

kernel32

advapi32

shell32

Exports

Exports

Sections

.text Size: 60KB - Virtual size: 58KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 8KB - Virtual size: 6KB

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 60KB - Virtual size: 58KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 8KB - Virtual size: 6KB

.reloc
Size: 4KB - Virtual size: 2KB