3de86bc9558af8031145ff707a88f1e4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3de86bc9558af8031145ff707a88f1e4_JaffaCakes118
Size

149KB
MD5

3de86bc9558af8031145ff707a88f1e4
SHA1

359fc6d8ff73f74bdc257e0b0edbd6dc1084014b
SHA256

d428ea30ab1ca8fd5330db25ebcef7f389cb4a9869b6ddcc4932632391309e71
SHA512

01379fd864588dbed89cd9624e789089e5104cf873887aacf86dcebda18ccb241e0cc133e5f0ac05ae1c7ce5049a42675c3f95fb2c4f5c361e5442eda1d8cd46
SSDEEP

3072:eyaFlTkZp+QBaNrqGx+F4q8qQ2FOj6VglJt3KXV6CtS3nBFXEHev:eyaF+ZF+x+OZ2FO1Jt3HbK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3de86bc9558af8031145ff707a88f1e4_JaffaCakes118

Files

3de86bc9558af8031145ff707a88f1e4_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e7a67205f50199cab72d9871f66b874c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempPathA
GetProcAddress
GetModuleHandleA
CopyFileA
LoadLibraryExA
FreeLibrary
DeleteFileA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
CreateFileA
WriteFile
CloseHandle
GetTempFileNameA
GetSystemTime
GetFileAttributesA
DeviceIoControl
SystemTimeToFileTime
GetCurrentProcessId
FreeLibraryAndExitThread
GetCurrentProcess
CreateFileW
GetFileSize
ReadFile
SetFilePointer
SetEndOfFile
GetModuleHandleW
CopyFileW
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
Sleep
DeleteFileW
ExitProcess
GetCommandLineA
CreateThread
GetSystemTimeAsFileTime
VirtualProtect
VirtualFree
GetLastError
GetVersionExA
MoveFileExW
GetTempFileNameW
GetTempPathW
GetModuleFileNameW
GetWindowsDirectoryW
VirtualAlloc

advapi32

QueryServiceStatusEx
StartServiceA
OpenSCManagerA
OpenServiceA
GetUserNameW
OpenProcessToken
RegCloseKey
RegSetValueExA
RegCreateKeyA
CloseServiceHandle

ntdll

RtlComputeCrc32
LdrAddRefDll
ZwImpersonateThread
ZwOpenThread
RtlEqualUnicodeString
ZwQueryInformationToken
wcsncpy
ZwOpenFile
ZwClose
ZwLoadDriver
strncat
ZwCreateEvent
RtlInitUnicodeString
_snwprintf
atoi
ZwTestAlert
RtlRandom
ZwRaiseHardError
RtlAdjustPrivilege
ZwQuerySystemInformation
sscanf
strncpy
_chkstk
memcpy
_snprintf
RtlImageNtHeader
ZwDeviceIoControlFile
memset

shlwapi

StrStrIW
SHDeleteKeyA
PathFileExistsW
StrStrIA
PathFileExistsA
PathAppendA
PathFindFileNameW
SHGetValueA
PathRemoveFileSpecA

imagehlp

CheckSumMappedFile

psapi

GetMappedFileNameW

rpcrt4

UuidCreateSequential

wininet

InternetCrackUrlA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetQueryOptionA
InternetSetOptionA
InternetCloseHandle
InternetOpenA

shell32

ShellExecuteW

ole32

CoCreateInstance
CoInitialize
CoUninitialize

winspool.drv

DeletePrintProvidorW
AddPrintProvidorW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.config
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e7a67205f50199cab72d9871f66b874c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ntdll

shlwapi

imagehlp

psapi

rpcrt4

wininet

shell32

ole32

winspool.drv

Sections

.text Size: 13KB - Virtual size: 13KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 10KB - Virtual size: 9KB

.config Size: 116KB - Virtual size: 115KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 13KB - Virtual size: 13KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 10KB - Virtual size: 9KB

.config
Size: 116KB - Virtual size: 115KB

.reloc
Size: 1KB - Virtual size: 1KB