41cfd2a08002e6cea701b34a62db1b41_JaffaCakes118

General

Target

41cfd2a08002e6cea701b34a62db1b41_JaffaCakes118
Size

334KB
MD5

41cfd2a08002e6cea701b34a62db1b41
SHA1

6dd161a849af3d94ec6ecc174c3a5a4d26ab3787
SHA256

b5fb9c7a3c9a8e70e289ab10a9a7c583f70e24a7937b72cf8a0a55d83ba30c3c
SHA512

ba1bbf37f5d0f3763c3313681571910385403e1e3bb4f0a16682832170fad0633b1b40eeb0c9c6f03fc206ecf154d5d37804a93f2fc338b279715d90c224013e
SSDEEP

6144:Q9Kwi/RX38tUMs4Qm7viTBXDc3JTSNj+wAWLCXTBcLbejQUpeCLiPDBRew:Q9Kp9Mts4pGQTUAkCXT4ibperPlkw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41cfd2a08002e6cea701b34a62db1b41_JaffaCakes118

Files

41cfd2a08002e6cea701b34a62db1b41_JaffaCakes118
.exe windows:4 windows x86 arch:x86

98cc9c229470a9938f8269e8829879f5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

DescribePixelFormat
AddFontResourceA
ExtEscape
Arc
GetBrushOrgEx
Chord
ExtSelectClipRgn
Escape
AddFontResourceW
GetBitmapDimensionEx
EqualRgn
ChoosePixelFormat
CreateEllipticRgn
ExtCreateRegion

advapi32

OpenThreadToken
RegReplaceKeyA
AdjustTokenPrivileges
RegNotifyChangeKeyValue
RegEnumValueA
NotifyChangeEventLog
RegOpenKeyExA
ClearEventLogW
RegisterEventSourceW
BackupEventLogW

shlwapi

PathUnquoteSpacesW
StrDupW
PathCompactPathA
SHRegWriteUSValueW
SHSetValueW
PathGetArgsW
StrRStrIA
PathBuildRootA
StrNCatA
PathIsPrefixW
PathFindExtensionW
PathIsFileSpecA
SHRegQueryInfoUSKeyA
SHRegQueryInfoUSKeyW
PathCompactPathW

kernel32

GetModuleHandleA
VirtualAllocEx
GetStdHandle
GetProcAddress
GetProfileSectionA
GetPrivateProfileSectionNamesA
GetStartupInfoA

netapi32

NetGroupAddUser
NetErrorLogClear
NetFileClose
NetGetDCName
NetGetJoinableOUs
NetGetAnyDCName
NetAuditWrite
NetGroupAdd
NetErrorLogWrite
NetConfigGet
NetFileEnum
Netbios
NetLocalGroupAddMembers
NetConnectionEnum
NetFileGetInfo

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 312KB - Virtual size: 410KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

98cc9c229470a9938f8269e8829879f5

Headers

File Characteristics

Imports

gdi32

advapi32

shlwapi

kernel32

netapi32

msvcrt

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 312KB - Virtual size: 410KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 312KB - Virtual size: 410KB

.rsrc
Size: 4KB - Virtual size: 3KB