034615fd7494749c3576e1767737074f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

034615fd7494749c3576e1767737074f_JaffaCakes118
Size

851KB
MD5

034615fd7494749c3576e1767737074f
SHA1

6c8bc4c51a08bccd478c9678246e9fea39cfb660
SHA256

d4ef673b65511e2ebac66570eb5b9779907770504154a7ec7e2f5d83e2310c09
SHA512

5e529989bba9558ded4d6b9a3ca89407adad57bf23645324e665450367abc40235a86eddb442683d48f2998a99d19674245ea8eca32d944f18c551a5ace670a5
SSDEEP

24576:pfys1oUSTGHxSE3j4VywqOGwnaBtDL/69Z:pfys6USiRDrwnmE9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
034615fd7494749c3576e1767737074f_JaffaCakes118

Files

034615fd7494749c3576e1767737074f_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e93741ecc786d6c3a3b9a61fc217a670

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtCompareTokens
RtlIpv6AddressToStringW
NtQuerySemaphore
PfxFindPrefix
NtRegisterThreadTerminatePort
ZwSetContextThread
ZwClose
NtDebugContinue
isalpha
ZwRemoveIoCompletion
LdrSetAppCompatDllRedirectionCallback
RtlDeleteAtomFromAtomTable
RtlSystemTimeToLocalTime
ZwPrivilegeCheck
ZwContinue
RtlEqualComputerName
ZwFreeVirtualMemory
RtlImageDirectoryEntryToData
RtlRegisterWait
RtlInitializeHandleTable
ZwFlushInstructionCache

kernel32

OpenProcess
SetConsoleLocalEUDC
FillConsoleOutputCharacterA
LoadLibraryA
SetCurrentDirectoryA
Heap32ListNext
LockFileEx
VirtualAlloc
FindFirstVolumeW
WritePrivateProfileStringW
GetConsoleKeyboardLayoutNameW
_hread
GlobalFix
SwitchToThread
RaiseException
GetModuleHandleW
InitializeCriticalSection
EnumResourceTypesA
EndUpdateResourceW
OutputDebugStringA
RtlUnwind
VerSetConditionMask

mssign32

PvkPrivateKeyLoadFromMemoryA
FreeCryptProvFromCert
PvkFreeCryptProv
PvkPrivateKeyAcquireContextFromMemory
SignerSign
PvkPrivateKeyLoad
PvkPrivateKeyReleaseContextA
SpcGetCertFromKey
PvkPrivateKeyAcquireContextFromMemoryA
SignerCreateTimeStampRequest
PvkPrivateKeyLoadA
PvkPrivateKeySaveToMemory
SignerTimeStampEx
PvkPrivateKeySaveToMemoryA
SignerSignEx

crtdll

_ismbckata
system
atol
_fileinfo_dll
_stricmp
_global_unwind2
_jn
_eof
_strlwr
strtoul
_wcsnset
wcscat
atexit
_mbsinc
_putw
_strninc
_unlink
vprintf
fread
wcsstr
_ismbcprint
fclose
getchar

msvcrt

ctime
_findnexti64
__argc
_safe_fdiv
_adj_fdivr_m32
ceil
iswalnum
putwchar
tolower
_mbsncpy
_fputwchar
strncat
_tzset
toupper
_mbctype
_ultow
_wspawnlp

Sections

.text
Size: 735KB - Virtual size: 735KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e93741ecc786d6c3a3b9a61fc217a670

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

mssign32

crtdll

msvcrt

Sections

.text Size: 735KB - Virtual size: 735KB

.rdata Size: 107KB - Virtual size: 107KB

.data Size: 4KB - Virtual size: 1.5MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 735KB - Virtual size: 735KB

.rdata
Size: 107KB - Virtual size: 107KB

.data
Size: 4KB - Virtual size: 1.5MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB