093533840c7a5bcadfd39dfd9ac3545a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

093533840c7a5bcadfd39dfd9ac3545a_JaffaCakes118
Size

38KB
MD5

093533840c7a5bcadfd39dfd9ac3545a
SHA1

934220e24e9e5fe12543fbf4598fbc22af90d55b
SHA256

02b16de00971bb92737c3aac56c0198177e20fba45ce729c656fa26fb030a563
SHA512

246dcdf86b23e0eacba8dcf15d547e7033b758e877935c7d7e1f620ab32afba798d2dde02f410a45cdb72ce7d37b578b9e0f2479a8f9a0b8d1fd76f1a3700fca
SSDEEP

768:W1xlI8OsmNwKh2I4ivajjytEsVrv6nSHQqRn4O:WVOzNwa4ivIjGtwSVnV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
093533840c7a5bcadfd39dfd9ac3545a_JaffaCakes118

Files

093533840c7a5bcadfd39dfd9ac3545a_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f1628942d7c9349e434f84672927752a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

StringFromGUID2
GetRunningObjectTable
CoCreateGuid
CLSIDFromString
OleUninitialize
CoMarshalInterThreadInterfaceInStream
MkParseDisplayName
OleRegGetUserType
CoSetProxyBlanket
GetHGlobalFromStream
CreateItemMoniker
CLSIDFromProgID
CoCreateFreeThreadedMarshaler
PropVariantClear
OleRegGetMiscStatus

advapi32

GetSecurityDescriptorDacl
GetAce
RegEnumKeyA
RegEnumKeyExA
OpenServiceA
RevertToSelf
RegEnumKeyExW
RegQueryValueW
GetLengthSid
CryptDestroyHash
UnregisterTraceGuids
GetSidIdentifierAuthority
IsTextUnicode
DeleteService
RegFlushKey
CheckTokenMembership
RegOpenKeyW
RegDeleteValueW
DeleteAce
OpenThreadToken

msvcrt

_iob
isspace
__p__commode
_except_handler3
_CIsqrt
calloc
__p__fmode
_amsg_exit
_vsnprintf
__setusermatherr
strncpy
fopen
strtoul
__set_app_type

ntdll

NtQuerySystemTime
RtlAcquireResourceShared
NtSetEvent
NtConnectPort
RtlOemStringToUnicodeString
wcscpy
_stricmp
RtlEqualSid
NtRequestWaitReplyPort
NtSetValueKey
RtlTimeToTimeFields
RtlMultiByteToUnicodeN
RtlEnterCriticalSection

shell32

ShellExecuteA
SHGetFolderPathW
ShellExecuteW
SHFileOperationW
SHBrowseForFolderW
DragQueryFileW
ShellExecuteExW
SHGetSpecialFolderPathW

comdlg32

PrintDlgW
GetFileTitleW
PageSetupDlgA
ChooseColorW
GetSaveFileNameA
FindTextW
ChooseColorA
GetFileTitleA

kernel32

GetCurrentThreadId
FindResourceA
ExitProcess
ReleaseMutex
TerminateProcess
OpenMutexA
GetCPInfo
GetCommandLineA
VirtualProtect
GetSystemDirectoryW
IsBadReadPtr
GetThreadLocale
FindClose
CreateThread
GetProcessHeap
GetConsoleMode
VirtualAlloc
GetCurrentProcessId
InterlockedCompareExchange
GetExitCodeThread
EnterCriticalSection
QueryPerformanceCounter

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 14KB - Virtual size: 217KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 489B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f1628942d7c9349e434f84672927752a

Headers

File Characteristics

Imports

ole32

advapi32

msvcrt

ntdll

shell32

comdlg32

kernel32

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 14KB - Virtual size: 217KB

.idata Size: 8KB - Virtual size: 8KB

.reloc Size: 512B - Virtual size: 489B

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 14KB - Virtual size: 217KB

.idata
Size: 8KB - Virtual size: 8KB

.reloc
Size: 512B - Virtual size: 489B