274ddd2c8d3590eb42373e5b81e28650_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

274ddd2c8d3590eb42373e5b81e28650_JaffaCakes118
Size

671KB
MD5

274ddd2c8d3590eb42373e5b81e28650
SHA1

87a87d9adbe64ad0446d1a435334ede11fd4192b
SHA256

6c529ebab6a4d7bb24bd4fa532cb73babbdea032a42987bed406f26f7fe6117f
SHA512

a0c6c9b66e11efc22abbc463947ddf68511d41d4e3d785440b0e542afcc968c392f8db9bc808230b69bcd2b37eb77fae8aa634c3a35be953fda8d1ac60abcc4c
SSDEEP

12288:5W7/3VkkcyzATnHquSx05gQNBHaHp3KWcF:c7/3VkPyzAeTx0S2HaHpmF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
274ddd2c8d3590eb42373e5b81e28650_JaffaCakes118

Files

274ddd2c8d3590eb42373e5b81e28650_JaffaCakes118
.exe windows:5 windows x86 arch:x86

159443daff09c202f6914330aa49eec9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcatA
lstrcmpA
SetLastError
lstrcmpiW
lstrcpyA
lstrcpynA
lstrlenA
VirtualAlloc
GetDriveTypeW
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResetEvent
ReleaseMutex
OpenProcess
MultiByteToWideChar
LocalReAlloc
LocalFree
LocalAlloc
LoadLibraryA
LeaveCriticalSection
IsBadReadPtr
InterlockedIncrement
InterlockedExchange
CloseHandle
InterlockedDecrement
InitializeCriticalSection
GetWindowsDirectoryA
GetVersionExA
GetTimeFormatA
GetTickCount
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocalTime
GetLastError
GetFileInformationByHandle
GetDateFormatA
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
FreeLibrary
FormatMessageA
FlushFileBuffers
ExpandEnvironmentStringsA
ExitProcess
EnterCriticalSection
DuplicateHandle
DeleteCriticalSection
CreateThread
CreateMutexA
CreateFileA
CreateEventA
lstrcmpiA

user32

LoadIconW
LoadCursorW
wvsprintfA
wsprintfA
UnregisterDeviceNotification
TranslateMessage
ShowWindow
SetWindowTextA
SetWindowLongA
SetTimer
SetThreadDesktop
SetForegroundWindow
SetFocus
SetActiveWindow
SendMessageTimeoutA
SendMessageA
RegisterDeviceNotificationA
PostThreadMessageA
PostQuitMessage
PostMessageA
PeekMessageA
OpenInputDesktop
MsgWaitForMultipleObjects
MessageBoxA
LoadStringW
LoadStringA
KillTimer
IsWindow
GetWindowThreadProcessId
GetParent
GetMessageA
GetForegroundWindow
GetDlgItem
FlashWindowEx
FindWindowA
EndDialog
DispatchMessageA
DialogBoxParamA
DestroyWindow
DefWindowProcA
CloseDesktop
CharUpperA
CharNextA
BroadcastSystemMessageA
AllowSetForegroundWindow
GetWindowLongA

advapi32

AddAccessAllowedAce
AddAce
CloseServiceHandle
ControlService
CopySid
CreatePrivateObjectSecurity
CreateProcessAsUserA
CreateServiceA
DeleteService
DeregisterEventSource
DestroyPrivateObjectSecurity
GetAce
GetAclInformation
GetKernelObjectSecurity
GetLengthSid
GetSecurityDescriptorDacl
GetSidLengthRequired
GetSidSubAuthority
GetSidSubAuthorityCount
InitializeAcl
InitializeSecurityDescriptor
InitializeSid
OpenProcessToken
OpenSCManagerA
OpenServiceA
OpenThreadToken
QueryServiceStatus
RegCloseKey
RegCreateKeyA
RegEnumKeyA
RegEnumValueA
RegOpenKeyA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegSetValueExA
RegisterEventSourceA
RegisterServiceCtrlHandlerExA
ReportEventA
SetKernelObjectSecurity
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorSacl
SetServiceStatus
StartServiceCtrlDispatcherA
AccessCheck

msvcrt

_XcptFilter
__dllonexit
__getmainargs
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_acmdln
_adjust_fdiv
_controlfp
_except_handler3
_exit
_initterm
_onexit
_purecall
atoi
exit
strncpy
strrchr
wcscmp
wcslen

Sections

.text
Size: 651KB - Virtual size: 650KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 596B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zzz0
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

159443daff09c202f6914330aa49eec9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

msvcrt

Sections

.text Size: 651KB - Virtual size: 650KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 596B

.zzz0 Size: 6KB - Virtual size: 5KB

.rsrc Size: 2KB - Virtual size: 1KB

.text
Size: 651KB - Virtual size: 650KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 596B

.zzz0
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 2KB - Virtual size: 1KB