f66d074bce2e02a5ea36584e0b8b17ad_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f66d074bce2e02a5ea36584e0b8b17ad_JaffaCakes118
Size

176KB
MD5

f66d074bce2e02a5ea36584e0b8b17ad
SHA1

c86e213ea6947527036b2aee51b8b11c714b4a51
SHA256

5120742c30762747d7676426e8e9d10e476ec9a8171e66e6062b36a423964061
SHA512

00b93465886f0a05ac9a08c2be4aa0d6906c8babb75856c3683a83aeecdbf80c42985fa603418112f3dff86c0a288941aba93809ae7f90cb07c958fceb34ed1d
SSDEEP

3072:a9RHcTRyfkJfPWdT2jIkdOJxwBMpyY6d739o1YIAuhXcpwub/7tvataDn:+x0wkJXvwkBMNmGhXsNz17

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f66d074bce2e02a5ea36584e0b8b17ad_JaffaCakes118

Files

f66d074bce2e02a5ea36584e0b8b17ad_JaffaCakes118
.exe windows:4 windows x86 arch:x86

99098af0778536592d98fefaf2a9b093

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoInitialize
CoRegisterSurrogate
CoRegisterClassObject
CoTaskMemFree
CoTaskMemAlloc

wtsapi32

WTSQueryUserToken
WTSLogoffSession
WTSOpenServerA
WTSCloseServer

mpr

WNetGetConnectionA
WNetGetUserA
WNetGetUniversalNameA

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertCreateCertificateContext
CryptDecodeObject
CertFreeCertificateContext
CryptAcquireCertificatePrivateKey
CryptImportPublicKeyInfo
CertAddCertificateContextToStore
CertOpenStore

netapi32

NetApiBufferFree
NetWkstaSetInfo
NetWkstaGetInfo

oleacc

WindowFromAccessibleObject
AccessibleObjectFromEvent
AccessibleObjectFromWindow

comdlg32

GetSaveFileNameA
ChooseFontA
ReplaceTextA
CommDlgExtendedError
GetOpenFileNameA

comctl32

ImageList_Destroy
ImageList_Remove
ImageList_SetBkColor
ImageList_SetDragCursorImage
ImageList_SetIconSize
ImageList_Write
ImageList_GetImageCount

kernel32

FatalAppExitA
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
VirtualAlloc
HeapReAlloc
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
WriteFile
RtlUnwind
HeapFree
VirtualFree
HeapCreate
HeapDestroy
GetCurrentThread
GetLastError
TlsGetValue
SetLastError
TlsFree
IsBadWritePtr
GetProcAddress
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
ResetEvent
SetEvent
GetCurrentProcess
LoadLibraryA
SetTapePosition
VirtualProtect
PulseEvent
WaitForSingleObject
CreateEventA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc

Sections

.text
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 880KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

99098af0778536592d98fefaf2a9b093

Headers

DLL Characteristics

File Characteristics

Imports

ole32

wtsapi32

mpr

crypt32

netapi32

oleacc

comdlg32

comctl32

kernel32

Sections

.text Size: 36KB - Virtual size: 34KB

.rdata Size: 48KB - Virtual size: 46KB

.data Size: 72KB - Virtual size: 880KB

.idata Size: 8KB - Virtual size: 4KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 36KB - Virtual size: 34KB

.rdata
Size: 48KB - Virtual size: 46KB

.data
Size: 72KB - Virtual size: 880KB

.idata
Size: 8KB - Virtual size: 4KB

.reloc
Size: 8KB - Virtual size: 4KB