fbc272c99bfd11939b0f4226d35c6452_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fbc272c99bfd11939b0f4226d35c6452_JaffaCakes118
Size

1.2MB
MD5

fbc272c99bfd11939b0f4226d35c6452
SHA1

70dbaeb2464c0873f18499728eb248ff5e635402
SHA256

2e39a253ec4a5b456469845e65e8cad1701353ae3fdb5af2ef0579175d99cc89
SHA512

36f7cec1f409784d13383d3816b579550e767b637c47565e4c2fc82be160b2b02a3b9835696ee7b7099ce77efcc5aa51cd0c19eb5c9b623a8dc3fcce47afa94b
SSDEEP

12288:Jvgnc9W2k7zAs5FPpYd96d24tRkx//LVpSbx0460FwUVE5Ic:oqIzAsuzbSbxJ6KV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fbc272c99bfd11939b0f4226d35c6452_JaffaCakes118

Files

fbc272c99bfd11939b0f4226d35c6452_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b714e698fb14d25b4d46d52f38d9a158

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ExitProcess
CreateFileA
MoveFileWithProgressA
FillConsoleOutputCharacterA
ReadConsoleInputA
EnumCalendarInfoExA
HeapFree
GetProcessHeap
HeapAlloc
ExitThread
Beep

user32

LoadStringW
ExitWindowsEx
MessageBeep
GetSystemMetrics
BroadcastSystemMessageA
GetCursorPos
GetMessageTime

advapi32

RegDeleteValueW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextW
OpenProcessToken
GetTokenInformation
RegSetValueExW
AllocateAndInitializeSid
LookupAccountSidW
FreeSid
OpenThreadToken
SetThreadToken
RevertToSelf
RegQueryInfoKeyW
RegQueryValueExW
RegNotifyChangeKeyValue
RegOpenKeyExW
CloseServiceHandle
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
RegOpenKeyW
RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
CryptSetProvParam
CryptGetProvParam
CryptReleaseContext
RegConnectRegistryW

rpcrt4

RpcImpersonateClient
RpcServerInqDefaultPrincNameW
RpcServerRegisterAuthInfoW
RpcServerRegisterIfEx
RpcBindingToStringBindingW
RpcServerListen
RpcStringFreeW
I_RpcBindingIsClientLocal
RpcStringBindingParseW
RpcServerRegisterIf
NdrServerCall2
RpcRaiseException
I_RpcBindingInqLocalClientPID
RpcServerUseProtseqEpW
RpcRevertToSelf

Exports

Exports

jkhtah

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b714e698fb14d25b4d46d52f38d9a158

Headers

File Characteristics

Imports

kernel32

user32

advapi32

rpcrt4

Exports

Exports

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 1.2MB - Virtual size: 1.2MB

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1.2MB - Virtual size: 1.2MB

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 2KB - Virtual size: 2KB