2c5d3853dd8657f4badd67cc74cdff84_JaffaCakes118

General

Target

2c5d3853dd8657f4badd67cc74cdff84_JaffaCakes118
Size

36KB
MD5

2c5d3853dd8657f4badd67cc74cdff84
SHA1

3643418bae6c7b2fa94747d481aaa9f381b20ccf
SHA256

06b0776f52ad33b797a41000eb608d2719188c77e84da0184a93b704733092e0
SHA512

99dde6b6e954f8be0394fc53e6e5e2b569b44aaca2009a1ee9981ff36eec8ba72bec545892e374e50d61e35f8dfaa74cbe74d1b98862790e14615ef09f1719b7
SSDEEP

768:/DU6w6v+0qbK02T2EtRlGvZsUpBjvgDXtfu:/DY6vx0u2ENsiUpBruk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2c5d3853dd8657f4badd67cc74cdff84_JaffaCakes118

Files

2c5d3853dd8657f4badd67cc74cdff84_JaffaCakes118
.exe windows:4 windows x86 arch:x86

133436ee79dd94ff6e448914e6e2e775

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

netapi32

NetUserGetLocalGroups
NetApiBufferFree

kernel32

CreateFileA
ExitProcess
GetVersionExA
FreeLibrary
WriteProcessMemory
GetCurrentProcess
WriteFile
SizeofResource
LoadResource
FindResourceA
GetLastError
SetFileAttributesA
GetSystemDirectoryA
lstrcpyA
GetTempPathA
FreeResource
LockResource
WideCharToMultiByte
MultiByteToWideChar
DeleteFileA
SwitchToThread
WaitForSingleObject
CreateEventA
OpenEventA
GetCurrentThreadId
MoveFileExA
MoveFileA
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
GetTickCount
CloseHandle
VirtualProtect
GetModuleHandleA
LoadLibraryA
GetProcAddress
GetModuleFileNameA
lstrlenA
HeapFree
GetProcessHeap
HeapAlloc
Sleep
lstrcatA
SetLastError

user32

PostThreadMessageA
GetMessageA
SendMessageTimeoutA
GetInputState
wsprintfA

advapi32

GetAclInformation
GetLengthSid
InitializeAcl
AddAce
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
SetFileSecurityA
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetFileSecurityA
LookupAccountNameA
GetUserNameA
GetAce
EqualSid

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

133436ee79dd94ff6e448914e6e2e775

Headers

DLL Characteristics

File Characteristics

Imports

netapi32

kernel32

user32

advapi32

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 13KB - Virtual size: 12KB

.data Size: 512B - Virtual size: 65KB

.rsrc Size: 18KB - Virtual size: 17KB

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 512B - Virtual size: 65KB

.rsrc
Size: 18KB - Virtual size: 17KB