40736af220fdb94fcbfc52d5eecf32f2_JaffaCakes118

General

Target

40736af220fdb94fcbfc52d5eecf32f2_JaffaCakes118
Size

185KB
MD5

40736af220fdb94fcbfc52d5eecf32f2
SHA1

b63414ec57f719ba072e9633a7fa9d69c45b96ae
SHA256

a86967861ba59190ef8628117692443fed18133ae5055d9476eada71269033f0
SHA512

94317b6d891eea955e37ea2200fc7d46c95708a3b5c0d0ba09c06bc7355ef724c6752d3f73cd6167d27d2adb9483fe4936163c8516827e9eebef04a60052b51a
SSDEEP

3072:/gG2yID+UuKItVSjJNk4bpu8exqt0DGxwwmczslxjuMgSVzMlPAm45P2XK3E:iKIItMjVbpuMey9/PuVWPAm6PIK3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40736af220fdb94fcbfc52d5eecf32f2_JaffaCakes118

Files

40736af220fdb94fcbfc52d5eecf32f2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0c1c7cf862573f86dccfce024415105d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrCmpNIA
StrStrA

newdev

UpdateDriverForPlugAndPlayDevicesW

setupapi

CM_Get_Sibling
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

iphlpapi

GetIpAddrTable

shell32

SHGetFolderPathW

kernel32

GetThreadPriority
GetModuleFileNameW
IsBadWritePtr
WideCharToMultiByte
MultiByteToWideChar
ReleaseMutex
GetProcessHeap
ReleaseSemaphore
AddAtomW
lstrlenA
IsBadReadPtr
GetProcAddress
GetCurrentThread
TerminateThread
QueryPerformanceCounter
LockResource
InterlockedDecrement
HeapFree
CreateSemaphoreA
GetTickCount
WaitForMultipleObjects
EnterCriticalSection
GlobalAlloc
InterlockedIncrement
GetSystemInfo
GetCurrentThreadId
EnumResourceLanguagesW
CreateMutexA
ResetEvent
GetSystemTime
GetGeoInfoW
SetThreadPriority
GetLastError
VirtualAlloc
LoadResource
Sleep
LoadLibraryA
GetModuleFileNameA
LoadLibraryW
VirtualFree
GetExitCodeThread
CreateFileW
FindResourceA
FreeLibrary
LeaveCriticalSection
GetCurrentProcessId
DisableThreadLibraryCalls
ExitProcess

Sections

.text
Size: 95KB - Virtual size: 239KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0c1c7cf862573f86dccfce024415105d

Headers

File Characteristics

Imports

shlwapi

newdev

setupapi

iphlpapi

shell32

kernel32

Sections

.text Size: 95KB - Virtual size: 239KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 86KB - Virtual size: 85KB

.rsrc Size: 512B - Virtual size: 4KB

.text
Size: 95KB - Virtual size: 239KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 86KB - Virtual size: 85KB

.rsrc
Size: 512B - Virtual size: 4KB