0e7c6165ba43b484950966b9c374ecda_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0e7c6165ba43b484950966b9c374ecda_JaffaCakes118
Size

44KB
MD5

0e7c6165ba43b484950966b9c374ecda
SHA1

3604c4739e2430ded2f30acbce95e15d57ad949c
SHA256

7d6513dad036d8ee04a016d19e430a8737e0af5119122d53184ed1ca091fd0ed
SHA512

d5c29e3294f3def9b364957818656f136d90ca48b75d21108ae430f7b925a23aa5fd9ccf632568bad1bb278d7396aff32e2d0ba028d2c9d0a6495716c0bfee68
SSDEEP

768:/mh7AlXH/2zzBp+coLtvqESKQ3d75kk9pM/jMywFku3SdxPrLK:sEl3/2f3qpy/KRknuL+0dNHK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e7c6165ba43b484950966b9c374ecda_JaffaCakes118

Files

0e7c6165ba43b484950966b9c374ecda_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f2affa6f89c5c38a69bd6f31b2f804a2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

apphelp

SdbReadWORDTagRef
SdbRegisterDatabaseEx
SdbReadStringTag
SdbReadWORDTag
SdbGetStringTagPtr
SdbOpenDatabase
SdbFindFirstTagRef
SdbGetPermLayerKeys
SdbReadBYTETagRef
SdbQueryFlagInfo
SdbReleaseDatabase
SdbQueryData
ApphelpCheckInstallShieldPackage
SdbGetMsiPackageInformation
ApphelpFreeFileAttributes
SdbReadDWORDTag
ApphelpCheckRunApp
SdbFindNextMsiPackage
SdbGetDatabaseVersion
SdbReadBYTETag
SdbCloseDatabase
SdbCloseApphelpInformation
ShimFlushCache
ApphelpShowDialog
ShimDumpCache
ApphelpFixMsiPackage
SdbEnumMsiTransforms
SdbOpenApphelpInformation
SdbSetPermLayerKeys
SdbGetEntryFlags

kernel32

GetEnvironmentVariableA
SetFilePointer
CreateMailslotA
GetSystemTime
GetLastError
lstrlenA
FileTimeToDosDateTime
GetFileAttributesA
ReadFile
GetFileTime
SetFirmwareEnvironmentVariableA
InterlockedDecrement
InterlockedFlushSList
VirtualFree
FileTimeToLocalFileTime
InterlockedIncrement
WaitNamedPipeA
lstrcmpiA
FileTimeToSystemTime
CompareStringA
InterlockedCompareExchange
OpenMutexA
CreateMutexA
ReleaseMutex
DisconnectNamedPipe
IsBadStringPtrA
ConnectNamedPipe
WaitForMultipleObjects
CreateFileA
CloseHandle
VirtualAllocEx
WriteFileEx
GetVersion

advpack

FileSaveRestore
TranslateInfStringEx
FileSaveMarkNotExist
DoInfInstall
RegSaveRestore
GetVersionFromFileEx
UserUnInstStubWrapper
FileSaveRestoreOnINF
RegSaveRestoreOnINF
NeedReboot
ExtractFiles

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f2affa6f89c5c38a69bd6f31b2f804a2

Headers

DLL Characteristics

File Characteristics

Imports

apphelp

kernel32

advpack

Sections

.text Size: 20KB - Virtual size: 20KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 22KB - Virtual size: 52KB

.text
Size: 20KB - Virtual size: 20KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 22KB - Virtual size: 52KB