120d1286289949abbb0fbb52519f8ed2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

120d1286289949abbb0fbb52519f8ed2_JaffaCakes118
Size

335KB
MD5

120d1286289949abbb0fbb52519f8ed2
SHA1

3840d467382f66cf91d783f683415c9a4ff1d2ce
SHA256

b4e605825aad4cbb760600c62d17d54971fe2dd5ab94393c71efec79fd36ef44
SHA512

08422d26ceeb4760f8f53fd42d0109f166327dc54ec210a111f12ffca9a9b15ae648c524350abfd127de9929e32399ae6040256e938898d13b7119335e334540
SSDEEP

6144:0JyUBuK3bIYMOP9xKHQBlAgl1IjL7hyAIPRWta2ZEK31UKAhb////////////0:07PsbOPTKHQBFb8L7hynP92TUO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
120d1286289949abbb0fbb52519f8ed2_JaffaCakes118

Files

120d1286289949abbb0fbb52519f8ed2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9808fd91eeba9456e0e4cd16a994bb9b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

OpenEventLogW
RegQueryValueExA
RegCreateKeyExA
RegEnumValueA
NotifyChangeEventLog
CloseEventLog
RegisterEventSourceA
RegOpenKeyA
RegOpenKeyExA
RegSaveKeyA
BackupEventLogA

shlwapi

StrChrW
PathStripPathW
PathMakeSystemFolderA
PathFindFileNameW
SHDeleteKeyA
SHQueryInfoKeyA
StrToIntW
PathRenameExtensionA
SHGetValueW
PathAddBackslashA
PathFindOnPathA
StrChrIW
PathCanonicalizeW

kernel32

GetModuleHandleA
VirtualAllocEx
SetEvent
PulseEvent
OpenMutexA
SuspendThread
GetProcAddress
InitializeCriticalSection
EnterCriticalSection
GlobalMemoryStatus
GetCPInfo
GetStringTypeA
VirtualAlloc
VerLanguageNameA
HeapSize
HeapCreate
VirtualLock
IsBadReadPtr
GlobalReAlloc
VirtualFree
WaitForSingleObject
GlobalSize
GetStartupInfoA

version

GetFileVersionInfoSizeA
VerFindFileA
VerInstallFileA
GetFileVersionInfoA
VerQueryValueA

netapi32

NetAuditClear
NetConfigSet
NetGroupAddUser
NetFileGetInfo
NetConfigGetAll
NetFileEnum
NetAuditWrite
NetConnectionEnum
NetErrorLogRead
NetErrorLogWrite
NetAuditRead
NetErrorLogClear
NetConfigGet
NetGroupAdd
NetGroupGetInfo
NetFileClose

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
__mb_cur_max
_isctype
_pctype

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 312KB - Virtual size: 414KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9808fd91eeba9456e0e4cd16a994bb9b

Headers

File Characteristics

Imports

advapi32

shlwapi

kernel32

version

netapi32

msvcrt

Sections

.text Size: 15KB - Virtual size: 14KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 312KB - Virtual size: 414KB

.rsrc Size: 6KB - Virtual size: 5KB

.text
Size: 15KB - Virtual size: 14KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 312KB - Virtual size: 414KB

.rsrc
Size: 6KB - Virtual size: 5KB