12b2472e5ca7ea41b6e8c67b592b8edf_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

12b2472e5ca7ea41b6e8c67b592b8edf_JaffaCakes118
Size

357KB
MD5

12b2472e5ca7ea41b6e8c67b592b8edf
SHA1

9e145f2d30d3118d1e895ba04cd7c3b599b6c26b
SHA256

b3a91645af6d2dbd6f222a0895e8ff4f3c28ef27535af6dbd91beed1e31798e9
SHA512

1d771c4caa2e790fa7762d327ebd4d87bc9bf81cb27559cb54ffee8bb17d6d186b12b12f637795defc821f3a9ffc6d4bc3114d5d7137bb3a7c02aaf79bfa3a29
SSDEEP

6144:m5WuM6UBMRQKgCgLjuk4cPGLx7e78Kn/OzfJGM+ZzQUAvg6KuxJu7KIHgnpWr:m5WuM6UBMRQvCgLjuJcOt7e78u/OzfJv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
12b2472e5ca7ea41b6e8c67b592b8edf_JaffaCakes118

Files

12b2472e5ca7ea41b6e8c67b592b8edf_JaffaCakes118
.exe windows:5 windows x86 arch:x86

33ea20257ce385ee8a8e72a11a99db38

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\mmut\mutator8.3\tmp\29a34a87fc15af2bb18b7ee3a34ff30d\installator1.pdb

Imports

user32

GetWindow

advapi32

RegEnumValueA
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
LookupAccountSidA
GetTokenInformation
OpenProcessToken

ws2_32

WSAStartup
WSACleanup

wininet

InternetOpenUrlA
InternetCloseHandle
InternetOpenA
InternetReadFile
HttpQueryInfoA

netapi32

NetUserGetInfo
NetApiBufferFree

kernel32

RtlUnwind
CompareStringW
CompareStringA
GetProcessHeap
SetEndOfFile
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetCompressedFileSizeA
GetCommandLineA
CloseHandle
UnlockFile
WriteFile
LockFile
SetFilePointer
ReadFile
CreateFileA
GetLogicalDriveStringsA
CreateMutexA
ExitProcess
OpenMutexA
Sleep
CreateProcessA
CopyFileA
GetModuleFileNameA
GetEnvironmentVariableA
GetShortPathNameA
GetCurrentProcess
MultiByteToWideChar
SetEnvironmentVariableA
CreateThread
SetFileAttributesA
GetLastError
CreateDirectoryA
GetLocalTime
GetVolumeInformationA
GetDriveTypeA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
GetSystemTimeAsFileTime
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileA
FindNextFileA
GetModuleHandleW
GetProcAddress
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetStdHandle
GetFileType
HeapFree
TerminateProcess
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
SetStdHandle
GetFullPathNameA
GetCurrentDirectoryA
GetModuleHandleA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RaiseException
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapReAlloc
VirtualAlloc

Sections

.text
Size: 249KB - Virtual size: 248KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

33ea20257ce385ee8a8e72a11a99db38

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

advapi32

ws2_32

wininet

netapi32

kernel32

Sections

.text Size: 249KB - Virtual size: 248KB

.rdata Size: 101KB - Virtual size: 101KB

.data Size: 5KB - Virtual size: 36KB

.text
Size: 249KB - Virtual size: 248KB

.rdata
Size: 101KB - Virtual size: 101KB

.data
Size: 5KB - Virtual size: 36KB