f2fc58b2df08d52f991cc204d1345ba2_JaffaCakes118

General

Target

f2fc58b2df08d52f991cc204d1345ba2_JaffaCakes118
Size

282KB
MD5

f2fc58b2df08d52f991cc204d1345ba2
SHA1

b15fa84e26511711eb7ee4076cd2768a43cf508a
SHA256

1c6eafc7acc4a53abb1f439ca12bbecea468fd13266b4f2ae0939feb949944ab
SHA512

b7f5c7bfa0074fc0f4a6d66b1c17773f6a2b035e991956b6dabc80c36e87faae506219cebff75eaa51df1fe4e72a4475769670fbef305247c43d152650fe8962
SSDEEP

6144:1YuUaYTcIuw4mPMZ50HFGgGfILJ/Zv/TGmUs+xkFrb+ANbsj:1JTB10w8L5F/TG/k59U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f2fc58b2df08d52f991cc204d1345ba2_JaffaCakes118

Files

f2fc58b2df08d52f991cc204d1345ba2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1350e794bfa1dcf13d500dc702c56937

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mprapi

MprConfigServerConnect
MprConfigServerDisconnect
MprConfigGetFriendlyName

kernel32

FreeEnvironmentStringsA
AddAtomA
TlsGetValue
GetCPInfo
TlsAlloc
GetOEMCP
VirtualQuery
VirtualFree
IsBadWritePtr
GetFileType
GetStartupInfoA
GetEnvironmentStrings
GetSystemTimeAsFileTime
GetStdHandle
GetModuleFileNameA
InterlockedExchange
GetVersionExA
UnhandledExceptionFilter
EnumResourceLanguagesA
HeapDestroy
GetCurrentProcessId
SetHandleCount
FreeEnvironmentStringsW
lstrcpynW
GetEnvironmentStringsW
GetACP
TlsFree
GetLocaleInfoA
QueryPerformanceCounter
SetLastError
VirtualAlloc
GetSystemInfo
HeapSize
HeapCreate
WriteFile
TlsSetValue
SetEndOfFile
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter

setupapi

CM_Get_Parent
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

iphlpapi

GetIpAddrTable

shell32

SHGetFolderPathW

newdev

UpdateDriverForPlugAndPlayDevicesW

user32

IsWindow
SendMessageA
EnumChildWindows
GetDlgItem
DestroyWindow
CreateWindowExW
GetWindowThreadProcessId

Sections

.text
Size: 140KB - Virtual size: 275KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1350e794bfa1dcf13d500dc702c56937

Headers

File Characteristics

Imports

mprapi

kernel32

setupapi

iphlpapi

shell32

newdev

user32

Sections

.text Size: 140KB - Virtual size: 275KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 138KB - Virtual size: 138KB

.rsrc Size: 512B - Virtual size: 4KB

.text
Size: 140KB - Virtual size: 275KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 138KB - Virtual size: 138KB

.rsrc
Size: 512B - Virtual size: 4KB