409729939688bf70c7653f203e354944_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

409729939688bf70c7653f203e354944_JaffaCakes118
Size

24KB
MD5

409729939688bf70c7653f203e354944
SHA1

8e54337faf2beb742149242c42f0c5ec426a6f03
SHA256

e2f98f96809312ddf87e743f5d62fcb9b859b69b6e53bec9524f318ec3c95845
SHA512

484f8f4c671ca263c91b96ade8a1eb8d73f9e0216cda046b7ea1174da12318bddfc60154f46f6ca7f1c091b55baf67656cb3cbab5f9fc4b9160353a7d814ab22
SSDEEP

384:akpvTW1UoZG69svTTtitee1V9Qq8eDzYQy2A6eq6lMJeU:akyZG+IiomAPeDzYQNv6az

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
409729939688bf70c7653f203e354944_JaffaCakes118

Files

409729939688bf70c7653f203e354944_JaffaCakes118
.exe windows:0 windows x86 arch:x86

5af20cb6d2295dd8a4ec61e7fdac8652

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

FileTimeToLocalFileTime
SystemTimeToTzSpecificLocalTime
BackupWrite
WideCharToMultiByte
GetCurrentProcess
GetVersion
LoadResource
GetTapePosition
CloseHandle
HeapCreate
FreeLibrary
SystemTimeToFileTime
VerSetConditionMask
GetModuleHandleA
EraseTape
GetSystemTime
LeaveCriticalSection
GetExitCodeThread
SetTapeParameters
FlushFileBuffers
UnhandledExceptionFilter
GetTapeStatus
GetProcessHeaps
WriteFile
GetUserDefaultLCID
GlobalFree
DeleteCriticalSection
FindClose
PrepareTape
EnterCriticalSection
SetFilePointer
FindVolumeMountPointClose
DeviceIoControl
GetProcessHeap
CreateMutexA
LoadLibraryA
HeapFree
GetProcAddress
SetEvent
OpenMutexA
GetLastError
ReleaseMutex
MultiByteToWideChar
SetErrorMode
GetFileInformationByHandle
SetEndOfFile
TerminateProcess
FileTimeToSystemTime
GetCurrentDirectoryA
SetUnhandledExceptionFilter
VirtualAlloc
BackupRead
ReleaseSemaphore
GetTimeZoneInformation
GetCurrentThread
CreateThread
SetFileTime
BackupSeek
LockResource

ntdll

iswctype
_aulldvrm
NtSetQuotaInformationFile
NtQueryQuotaInformationFile
wcstoul
wcscspn
isdigit

netapi32

NetServerEnum
NetApiBufferFree
NetApiBufferSize
NetWkstaGetInfo

setupapi

SetupFindNextLine

syssetup

AsrRestorePlugPlayRegistryData
AsrFreeContext

shell32

SHGetMalloc

mpr

WNetCloseEnum

gdi32

CombineRgn
GetMapMode
Polygon
CreateBitmap
CreateRectRgn
CreateCompatibleDC
Rectangle
PatBlt
SelectObject

advapi32

InitializeSecurityDescriptor
RegQueryValueExA
OpenThreadToken
ReadEncryptedFileRaw
DeleteAce
CloseServiceHandle
GetAce
RegOpenKeyExA
GetSecurityDescriptorDacl
AddAccessAllowedAce
OpenProcessToken
QueryServiceStatus
FreeSid
WriteEncryptedFileRaw
EqualSid
SetSecurityDescriptorDacl
CheckTokenMembership
RegCloseKey
AdjustTokenPrivileges

user32

CreateIconFromResource
GetKeyState
GetNextDlgGroupItem
DispatchMessageA
ChildWindowFromPoint
SetParent
TranslateMessage
GetMenuItemCount
DestroyWindow
InflateRect
RemoveMenu
InvalidateRect
CreateWindowExA
CopyRect
DefWindowProcA
GetWindowThreadProcessId
GetMessageA
DrawFocusRect
GetMenu
SendMessageA
DeleteMenu
SetTimer
GetMenuItemID
GetSubMenu
ReleaseDC
GetFocus
SetWindowPos
CallNextHookEx
WindowFromPoint
InvalidateRgn
GetWindowRect
IsWindow
GetIconInfo
KillTimer
BringWindowToTop
ShowWindow
GetDlgItem
SetActiveWindow
RegisterClassExA
GetDesktopWindow
GetSysColor
GetDC
GetCursorPos
ScreenToClient
GetParent
FlashWindow
UpdateWindow

ole32

CLSIDFromString
CoInitializeSecurity
CoUninitialize
CoCreateInstance
CoCreateGuid

msvcrt

__p__commode
wcsrchr
time
_wcsnicmp
_filelength
_ftol
_wcmdln
wcschr
_onexit
_controlfp
fwrite
ftell
free
_XcptFilter
wprintf
_mbscpy
_getpid
_wtoi
_cexit
fflush
fclose
fread
wcspbrk
isalpha
_except_handler3
_wfopen
_wcsicmp
_wcsupr
_wcsdup
malloc
wcsncmp
wcscpy
memmove
_purecall
_tzset
_c_exit
_wcslwr
swscanf
wcscat
_initterm
_mbslen
_putenv
_vsnwprintf
__dllonexit
__wgetmainargs
_CxxThrowException
_wcsrev
_open_osfhandle
exit
_fdopen
wcsncat
_snwprintf

comctl32

ImageList_ReplaceIcon
ImageList_GetImageCount
InitCommonControlsEx
ImageList_AddMasked
ImageList_GetIcon

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 962B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5af20cb6d2295dd8a4ec61e7fdac8652

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ntdll

netapi32

setupapi

syssetup

shell32

mpr

gdi32

advapi32

user32

ole32

msvcrt

comctl32

Sections

.text Size: 17KB - Virtual size: 17KB

.data Size: 1024B - Virtual size: 962B

.rsrc Size: 5KB - Virtual size: 44KB

.text
Size: 17KB - Virtual size: 17KB

.data
Size: 1024B - Virtual size: 962B

.rsrc
Size: 5KB - Virtual size: 44KB