3de54368ac031c28133c5a23136e0b17_JaffaCakes118

General

Target

3de54368ac031c28133c5a23136e0b17_JaffaCakes118
Size

754KB
MD5

3de54368ac031c28133c5a23136e0b17
SHA1

01ead31083b952c2b3bc20a34c19b5a184f0358d
SHA256

2627bb6b0d1a71cfbde0f3d1370cb177175b31441b78349c4e253ea707d4974e
SHA512

2f778578587d2d7b563297eb29dd7ddc0031f9cf16c4496af7199116c42bd7f0ee04e91d90fbbe7cff85d472a633ca4c07b873d081596c8c70c36abe20e56aef
SSDEEP

12288:Uif3L5Rmmznxd09FBmqBhYDqF5tGf6giDfkyOsCXqIPSWf6q1UJRB8D+1dSD+W6J:Ff9Rmmzn8PBhY+F5tGniw4MZPSWf6q1s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3de54368ac031c28133c5a23136e0b17_JaffaCakes118

Files

3de54368ac031c28133c5a23136e0b17_JaffaCakes118
.exe windows:5 windows x86 arch:x86

06dc2aec616bd1a40d42803110251fa8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegEnumValueW
AddAce
LookupPrivilegeNameW
IsValidSecurityDescriptor
CopySid
LookupAccountSidW
OpenSCManagerW
RegDeleteKeyW
OpenServiceW
GetKernelObjectSecurity
AddAccessAllowedAce
QueryServiceStatus
MapGenericMask
QueryServiceConfigW
RegDeleteValueW
RegCreateKeyW
RegOpenKeyExW
GetAce
RegOpenKeyW
LookupPrivilegeValueW
GetSidIdentifierAuthority

kernel32

GetCurrentThreadId
VirtualLock
GetTickCount
VirtualFree
VirtualAlloc
GetCurrentProcessId
GetModuleHandleW
CopyFileExW
PrivMoveFileIdentityW
SetConsoleDisplayMode
EnumCalendarInfoW
ScrollConsoleScreenBufferW
GetFileAttributesExA
EnumCalendarInfoExW
SetDefaultCommConfigW
SetInformationJobObject
SetFileTime
RegisterWowExec
Process32Next
GetComputerNameA
GetCurrencyFormatW

ntdll

ZwNotifyChangeMultipleKeys
RtlGetAce
RtlFindLeastSignificantBit
NtExtendSection
NtNotifyChangeDirectoryFile
RtlEnumerateGenericTable
NtVdmControl
ZwTerminateThread
mbstowcs
ZwOpenProcess
ZwQueryEaFile
NtShutdownSystem
ZwQueryInformationAtom
ZwOpenEventPair
RtlInitializeSid
RtlGetOwnerSecurityDescriptor
RtlAddAttributeActionToRXact
NtQueryInformationThread

Sections

.text
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

06dc2aec616bd1a40d42803110251fa8

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

ntdll

Sections

.text Size: 65KB - Virtual size: 64KB

.data Size: 2KB - Virtual size: 18KB

.rsrc Size: 1024B - Virtual size: 992B

.text
Size: 65KB - Virtual size: 64KB

.data
Size: 2KB - Virtual size: 18KB

.rsrc
Size: 1024B - Virtual size: 992B