3022d0030732ae273538def0cd32680a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3022d0030732ae273538def0cd32680a_JaffaCakes118
Size

59KB
MD5

3022d0030732ae273538def0cd32680a
SHA1

9fef04fdd7a532f4dd59c789b91343f96a006ae0
SHA256

c04c57afa362bb0b3f626c8c5f1c20a85f8b735c9270a26e1d4649fd3eaee015
SHA512

87c6dc6652b46dae62bbb79d6b0c949b342579d26ed14ad014c88f06b32025d7b5b4f3aceb3f70332068b91680ce03cd9d3427f05a3d578edc7543b5d64ee8a6
SSDEEP

1536:VEfCS81bf0dnIL8tcRxLKlCYDhUGxA0x:aCf1gcR9oCYDhUGxTx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3022d0030732ae273538def0cd32680a_JaffaCakes118

Files

3022d0030732ae273538def0cd32680a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9dcfd950f7e2401684bfb3463868f579

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
lstrcatW
lstrcpyW
GetEnvironmentVariableW
GetShortPathNameW
GetModuleFileNameW
Sleep
OpenProcess
lstrcmpW
WaitForSingleObject
HeapFree
HeapAlloc
GetProcessHeap
GetLastError
SetProcessPriorityBoost
WinExec
WideCharToMultiByte
lstrlenW
SetFilePointer
CopyFileW
FindClose
FindFirstFileW
CreateDirectoryW
MultiByteToWideChar
lstrlenA
lstrcmpiA
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleHandleW
FindResourceW
SizeofResource
LoadResource
GlobalAlloc
LockResource
GetStartupInfoW
CreateFileW
WriteFile
GlobalFree
GetVersionExW
CreateToolhelp32Snapshot
Process32FirstW
lstrcmpiW
Process32NextW
CreateEventW
CloseHandle

netapi32

NetUserGetInfo
NetApiBufferFree

msvcrt

__p__commode
__p__fmode
__set_app_type
_controlfp
memset
memcpy
_wcsupr
sprintf
swprintf
_exit
_XcptFilter
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
_except_handler3

user32

SetProcessWindowStation
OpenWindowStationW
OpenDesktopW
GetProcessWindowStation
CloseDesktop
EndDialog
GetWindowThreadProcessId
PostMessageW
SetUserObjectSecurity
GetUserObjectSecurity
EnumWindows
CloseWindowStation

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

advapi32

OpenProcessToken
SetSecurityDescriptorDacl
CopySid
AddAce
GetAce
InitializeAcl
GetLengthSid
GetAclInformation
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
GetTokenInformation
GetUserNameW
CreateProcessAsUserW

shell32

SHChangeNotify
ShellExecuteExW
SHGetSpecialFolderPathW

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9dcfd950f7e2401684bfb3463868f579

Headers

File Characteristics

Imports

kernel32

netapi32

msvcrt

user32

userenv

advapi32

shell32

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 1024B - Virtual size: 832B

.rsrc Size: 48KB - Virtual size: 48KB

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 1024B - Virtual size: 832B

.rsrc
Size: 48KB - Virtual size: 48KB