ee92e9accc62c1298f4e9f51cd016603_JaffaCakes118

General

Target

ee92e9accc62c1298f4e9f51cd016603_JaffaCakes118
Size

283KB
MD5

ee92e9accc62c1298f4e9f51cd016603
SHA1

ccfa4bc0bcf25507b0656e5ca8bd918c4edc446a
SHA256

2df54edb447794092100c4eceff2be85dae3d484fd6ae3eff6f54d08038c7cf5
SHA512

04a6f53afdfb1e7e9e96f8b6b93e4cebb8d88ffecfea69efeb381dd2b76c679fe2a4acab157c26e9feb18f064e30089298d3f1c9fb4ad2578c4cbdc14601aab4
SSDEEP

6144:HyA2qTDSbyAf69YMzainA/zcorVGUV3+anGGu14:ptDSbJf69YMzayuBDV3xGF4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ee92e9accc62c1298f4e9f51cd016603_JaffaCakes118

Files

ee92e9accc62c1298f4e9f51cd016603_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d41a9b2aa381390197ba50e53fd4e3ac

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

iphlpapi

GetIpAddrTable

setupapi

CM_Get_Parent
CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status

shell32

SHGetFolderPathW

kernel32

VirtualAlloc
GetEnvironmentStrings
WriteFile
GetACP
AddAtomA
SetLastError
FreeEnvironmentStringsW
GetStartupInfoA
GetCPInfo
IsBadWritePtr
GetFileType
GetCurrentProcess
VirtualFree
TlsFree
TlsGetValue
GetVersionExA
FreeEnvironmentStringsA
EnumResourceLanguagesA
QueryPerformanceCounter
GetOEMCP
SetHandleCount
HeapDestroy
TerminateProcess
VirtualQuery
lstrcpyW
TlsSetValue
GetEnvironmentStringsW
InterlockedExchange
GetStdHandle
GetSystemInfo
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetLocaleInfoA
HeapSize
UnhandledExceptionFilter
TlsAlloc
HeapCreate
SetEndOfFile
SetUnhandledExceptionFilter

newdev

UpdateDriverForPlugAndPlayDevicesW

user32

EnumChildWindows
IsWindow
DestroyWindow
SendMessageA
GetDlgItem
CreateWindowExW
GetWindowThreadProcessId

mprapi

MprConfigServerDisconnect
MprConfigServerConnect
MprConfigGetFriendlyName

Sections

.text
Size: 145KB - Virtual size: 277KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d41a9b2aa381390197ba50e53fd4e3ac

Headers

File Characteristics

Imports

iphlpapi

setupapi

shell32

kernel32

newdev

user32

mprapi

Sections

.text Size: 145KB - Virtual size: 277KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 134KB - Virtual size: 133KB

.rsrc Size: 512B - Virtual size: 4KB

.text
Size: 145KB - Virtual size: 277KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 134KB - Virtual size: 133KB

.rsrc
Size: 512B - Virtual size: 4KB