03ae9d1ebb548a93d2f562a535d97a9d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

03ae9d1ebb548a93d2f562a535d97a9d_JaffaCakes118
Size

259KB
MD5

03ae9d1ebb548a93d2f562a535d97a9d
SHA1

8a2a5c3991dc4015f8527ce348f6e32bf43a52f3
SHA256

826e6d5b67175449b84af16c41e7f8f2878b6cf48b5a06cae144a1b816e1d3e7
SHA512

9a3ecfa27878cd6abc60ed8c9f96b0b5188d101ed79e827f650851e634e132b33bb8b08461cefa87e7750149ec372ac8c7c27f838353731a03e22e33a2edd18b
SSDEEP

6144:dx9PP90i6dC9i2e3ijBHJ6/gkToLcXKAJEBdW7YXxglx3Jysk+:b9n90i6YivuB8tgeLQaljJk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
03ae9d1ebb548a93d2f562a535d97a9d_JaffaCakes118

Files

03ae9d1ebb548a93d2f562a535d97a9d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ab90d46e5ea5228006ef44ca800e71dd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WideCharToMultiByte
OpenEventA
LeaveCriticalSection
IsDebuggerPresent
EnterCriticalSection
OpenMutexA
PulseEvent
VirtualUnlock
HeapAlloc
GlobalMemoryStatusEx
GetModuleHandleA
VirtualLock
CreateMutexA
SleepEx
GlobalMemoryStatus
VirtualAlloc
CreateEventA
SetUnhandledExceptionFilter
HeapReAlloc
GetProcessHeap
CloseHandle
GetSystemDirectoryA
ExpandEnvironmentStringsW
CreateSemaphoreW
UnhandledExceptionFilter
GetSystemTimeAsFileTime
CreateSemaphoreA
FreeLibrary
VirtualProtect
DeleteCriticalSection
GetCurrentThreadId
OutputDebugStringA
WaitForSingleObjectEx
WaitForSingleObject
lstrcpyA
ReleaseMutex
OpenSemaphoreA
QueryPerformanceFrequency
VirtualFree
lstrcpyW
HeapDestroy
OpenProcess
HeapFree
HeapValidate
GetTempFileNameA
GetTempPathA
GetWindowsDirectoryA
ExpandEnvironmentStringsA
GetModuleHandleW
ReleaseSemaphore
GetSystemInfo
HeapSize
SetErrorMode
ResetEvent
IsValidLocale
VirtualAllocEx

user32

OemToCharBuffA
GetSystemMetrics
CharToOemBuffA
ExitWindowsEx
CharLowerA
CharLowerW
CharUpperW
CharUpperA
wsprintfA

advapi32

AddAccessAllowedAce
GetLengthSid
LookupAccountSidA
InitializeAcl
OpenThreadToken
SetSecurityDescriptorSacl
DuplicateToken
AllocateAndInitializeSid
SetSecurityDescriptorDacl
SetThreadToken
InitializeSecurityDescriptor
OpenProcessToken
GetUserNameA
DuplicateTokenEx
CopySid
FreeSid
EqualSid
RevertToSelf
AdjustTokenPrivileges
GetTokenInformation
LookupPrivilegeValueA
ImpersonateLoggedOnUser

shlwapi

PathUnExpandEnvStringsA
PathUnExpandEnvStringsW
PathIsRootA
SHRegOpenUSKeyA
PathIsUNCServerW
SHReleaseThreadRef
SHRegEnumUSValueA
SHDeleteValueA
SHRegCloseUSKey
StrIsIntlEqualA
PathIsDirectoryEmptyW
AssocQueryStringByKeyW
SHSkipJunction
PathFindFileNameW
StrCmpLogicalW
UrlIsNoHistoryA
PathRemoveBackslashW
PathFindExtensionW
PathSearchAndQualifyW
UrlUnescapeW
PathIsUNCServerShareA
StrStrIA
SHRegDeleteUSValueA
PathCreateFromUrlA
StrSpnW
PathIsLFNFileSpecW
StrFormatKBSizeA
PathGetDriveNumberW
HashData
SHDeleteValueW
PathFindSuffixArrayW
PathRemoveBackslashA
PathFindFileNameA
UrlGetLocationA
PathBuildRootW
SHStrDupA
UrlCanonicalizeW
SHRegCreateUSKeyW
StrToIntW

msdart

MPCSUninitialize
?sm_wDefaultSpinCount@CCritSec@@1GA
MpHeapAlloc

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.gZmP
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.YcZHVwV
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ESGZHgW
Size: 1024B - Virtual size: 711B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 209KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.WvWd
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.uXdb
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 7KB - Virtual size: 460KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.IRysj
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.VInjsTj
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ab90d46e5ea5228006ef44ca800e71dd

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

msdart

Sections

.text Size: 20KB - Virtual size: 20KB

.gZmP Size: 1KB - Virtual size: 1KB

.YcZHVwV Size: 2KB - Virtual size: 2KB

.ESGZHgW Size: 1024B - Virtual size: 711B

.rdata Size: 209KB - Virtual size: 208KB

.WvWd Size: 2KB - Virtual size: 2KB

.uXdb Size: 3KB - Virtual size: 2KB

.data Size: 7KB - Virtual size: 460KB

.IRysj Size: 1KB - Virtual size: 1KB

.rsrc Size: 6KB - Virtual size: 6KB

.VInjsTj Size: 3KB - Virtual size: 2KB

.text
Size: 20KB - Virtual size: 20KB

.gZmP
Size: 1KB - Virtual size: 1KB

.YcZHVwV
Size: 2KB - Virtual size: 2KB

.ESGZHgW
Size: 1024B - Virtual size: 711B

.rdata
Size: 209KB - Virtual size: 208KB

.WvWd
Size: 2KB - Virtual size: 2KB

.uXdb
Size: 3KB - Virtual size: 2KB

.data
Size: 7KB - Virtual size: 460KB

.IRysj
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 6KB - Virtual size: 6KB

.VInjsTj
Size: 3KB - Virtual size: 2KB