3d443ec4b4df7ad50d726a99702a1a1f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3d443ec4b4df7ad50d726a99702a1a1f_JaffaCakes118
Size

88KB
MD5

3d443ec4b4df7ad50d726a99702a1a1f
SHA1

48215da730c12ba523ba86531e3844d66faff9c7
SHA256

eb9ec97608c42927debaec6f2e3b2b34d8333f0d9b21b32d97ccfe9a9b465f85
SHA512

7db994a98f42eacc798fb71995be1baba9e938d551fb052a40cd5d605f4025a2ffa3c09a28f7c71fed7b6192039e5e357ce7a56575fcc52dd0b4a9fe8d9d5292
SSDEEP

768:1tn/gYIcJ7wgInfam5+eNNVU44IGRbXXOAae64oa2elwqNgzjTSVPrh:nXqgpoNcaaoaxNNIPKrh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3d443ec4b4df7ad50d726a99702a1a1f_JaffaCakes118

Files

3d443ec4b4df7ad50d726a99702a1a1f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dfe229467b2ca67974c77148cecf4be0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcmpiA
lstrcpynA
GetCommandLineA
GetModuleHandleA
GetStartupInfoA
GetVersion
SetThreadPriority
GetCurrentThread
SetPriorityClass
lstrcatA
GetEnvironmentVariableA
CloseHandle
ResumeThread
SetThreadContext
FlushInstructionCache
WriteProcessMemory
VirtualProtectEx
GetThreadContext
DuplicateHandle
CreateProcessA
GetVersionExA
IsBadCodePtr
ExitProcess
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
WriteFile
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetOEMCP
GetACP
FindFirstFileA
FindNextFileA
FindClose
GetProcAddress
LoadLibraryA
FreeLibrary
GetModuleFileNameA
RemoveDirectoryA
GetFileAttributesA
SetFileAttributesA
DeleteFileA
LocalFree
MoveFileExA
GetWindowsDirectoryA
GetShortPathNameA
GetPrivateProfileSectionA
lstrcpyA
lstrlenA
WritePrivateProfileSectionA
GetCurrentProcess
OutputDebugStringA
GetLastError
FormatMessageA
IsBadReadPtr
LocalAlloc
GetCPInfo
HeapSize
TerminateProcess
HeapReAlloc
RaiseException
RtlUnwind
HeapAlloc
HeapFree

user32

wvsprintfA
DispatchMessageA
wsprintfA
LoadStringA
LoadIconA
RegisterClassA
CreateDialogParamA
GetMessageA
IsDialogMessageA
TranslateMessage
GetClassInfoA
GetDialogBaseUnits
GetSystemMenu
AppendMenuA
ShowWindow
DestroyWindow
PostQuitMessage
SetDlgItemTextA
DialogBoxParamA
DefWindowProcA
EndDialog
GetDlgItem
GetWindowTextA
SetWindowTextA
SendNotifyMessageA

gdi32

SetBkColor
GetStockObject
RemoveFontResourceA
CreateSolidBrush

advapi32

RegDeleteValueA
RegOpenKeyA
RegOpenKeyExA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
LookupAccountNameA
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
OpenProcessToken
GetTokenInformation
SetSecurityDescriptorOwner
SetFileSecurityA
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumValueA

shell32

ShellExecuteExA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHGetMalloc
SHChangeNotify

ole32

OleInitialize
OleUninitialize

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dfe229467b2ca67974c77148cecf4be0

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

Sections

.text Size: 32KB - Virtual size: 31KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 16KB - Virtual size: 16KB

.rsrc Size: 28KB - Virtual size: 27KB

.text
Size: 32KB - Virtual size: 31KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 28KB - Virtual size: 27KB