08cde4b38e32388a52917ed8735309e1_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

08cde4b38e32388a52917ed8735309e1_JaffaCakes118
Size

55KB
MD5

08cde4b38e32388a52917ed8735309e1
SHA1

0904d4ef7668f88fdf6b341a39eea5d918c1e162
SHA256

6fb00547fd4cf0dcd4f5be2901efac9ff30d4936cba8466eece9f3ed142057fe
SHA512

718c345a1752d7ba7f7191b23b3f7b8d6ebecdadb85336ff7288502a34504e46efc2bd274ff53ce1ad349a91a11a161e17ffb1ef2e14620e52ebbd57bfecaa8d
SSDEEP

1536:/yjYsXl3d3gDtALJpP56UmZMIX8n2+obojTku:CDP56UxIMnXxjh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
08cde4b38e32388a52917ed8735309e1_JaffaCakes118

Files

08cde4b38e32388a52917ed8735309e1_JaffaCakes118
.exe windows:5 windows x86 arch:x86

49fa7622ac4d705f38d69a5b22d73805

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathMakeSystemFolderW
StrToInt64ExW
PathIsRootA
SHDeleteEmptyKeyW
PathRemoveExtensionW
StrPBrkA
ColorRGBToHLS
StrFormatByteSizeW
StrRetToBufW
StrChrW
PathIsSystemFolderA
UrlCanonicalizeW
StrRetToBufA
PathIsLFNFileSpecW
PathIsUNCServerShareA

kernel32

GetModuleHandleW
GetNextVDMCommand
LoadLibraryA
GetCPInfoExW
FindNextChangeNotification
GetTempPathW
GetProcessHeap
GlobalFix
VirtualAlloc
SetComPlusPackageInstallStatus
lstrcatW
FindNextFileA
GetSystemTimeAsFileTime
PostQueuedCompletionStatus
GetProcessWorkingSetSize
WriteProfileSectionA
CreateEventW
GetProcAddress
InterlockedDecrement
TzSpecificLocalTimeToSystemTime
WritePrivateProfileSectionA
GetConsoleAliasesA
BindIoCompletionCallback
GetConsoleScreenBufferInfo
FreeLibrary

wldap32

ldap_create_vlv_controlW
ldap_modify_ext_s
ldap_parse_referenceA
LdapUnicodeToUTF8
ldap_memfreeW
ldap_parse_extended_resultW
ldap_openW
ldap_get_values_len
ldap_parse_vlv_controlW
ldap_rename_extA
ldap_control_freeA
ldap_addA
ldap_parse_page_controlW
ldap_parse_referenceW
ldap_search_sA
ldap_stop_tls_s
ldap_compare_sW
ldap_modrdn2W
ldap_delete_s

schannel

MakeSignature
QuerySecurityPackageInfoW
SslEmptyCacheW
InitializeSecurityContextA
EnumerateSecurityPackagesW
InitSecurityInterfaceA
ApplyControlToken
AcquireCredentialsHandleA
InitSecurityInterfaceW
VerifySignature
InitializeSecurityContextW
QuerySecurityPackageInfoA
FreeContextBuffer
QueryContextAttributesA
SpLsaModeInitialize

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 10KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

49fa7622ac4d705f38d69a5b22d73805

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

wldap32

schannel

Sections

.text Size: 19KB - Virtual size: 19KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 10KB - Virtual size: 59KB

.rsrc Size: 19KB - Virtual size: 18KB

.reloc Size: 512B - Virtual size: 268B

.text
Size: 19KB - Virtual size: 19KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 10KB - Virtual size: 59KB

.rsrc
Size: 19KB - Virtual size: 18KB

.reloc
Size: 512B - Virtual size: 268B