432fece129d54b499bca43a0242fdf4d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

432fece129d54b499bca43a0242fdf4d_JaffaCakes118
Size

2.3MB
MD5

432fece129d54b499bca43a0242fdf4d
SHA1

f756ece1f53d1d9b375a1db20c05a78f585d2cfc
SHA256

a545fc96b249d36ed344585f21c0faf3e069b3fa81fe9aca11d0ae3f0d250b36
SHA512

91a6615606026d17cdbe2f3a3a0510b613313fcbabef2e04ca068da404299ce9edaf7aaf7b764570c2deb053d0f489292fedadaef1ee7a2c723d2c5662bae35e
SSDEEP

49152:/cNtF8RVMn6jX85keJFrecSq+OcVOVriOldZ3Cq/2uPcT:kzWq6jde7reDq+OcVOVdldZyq/Ny

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
432fece129d54b499bca43a0242fdf4d_JaffaCakes118

Files

432fece129d54b499bca43a0242fdf4d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

818acc8541d0ab475362b95f869f0024

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtCancelTimer
wcsstr
NtWriteFileGather
RtlNewSecurityObject
wcslen
NtClose
NtOpenFile
RtlCutoverTimeToSystemTime
ZwClose
_wcslwr

mtxclu

MtxCluGetComputerNameW
MtxCluGetDTCVirtualServerNameW
MtxCluGetDTCStatusW
MtxCluIsClusterPresentExW
MtxCluIsClusterPresent
MtxCluIsSameNodeW
MtxCluBringOnlineDTCW

usp10

ScriptGetFontProperties
ScriptStringFree
ScriptStringAnalyse
ScriptGetProperties
ScriptStringGetLogicalWidths
LpkPresent
ScriptIsComplex
UspAllocCache
ScriptStringGetOrder
UspFreeMem
ScriptRecordDigitSubstitution

mprapi

MprAdminConnectionEnum
MprAdminInterfaceSetInfo
MprInfoBlockAdd
MprAdminServerDisconnect
MprConfigBufferFree
MprAdminInterfaceDisconnect
MprAdminInterfaceTransportAdd
MprInfoBlockRemove
MprConfigGetGuidName
MprConfigInterfaceCreate
MprAdminServerConnect
MprAdminUserSetInfo
MprConfigServerConnect
MprConfigInterfaceTransportSetInfo
MprInfoDelete
MprAdminMIBEntryGetNext
MprAdminMIBEntryGet
MprAdminMIBBufferFree
MprAdminInterfaceTransportSetInfo

msvcrt

__p__commode
__p__osver
rand
_fstati64
setbuf
__p__iob
iswspace
__p__fmode
difftime
_access
_mktemp

user32

GetDC
SetForegroundWindow
DdeQueryStringA
VkKeyScanW
GetMenu
GetSystemMetrics
GetFocus
LoadCursorW
SetUserObjectSecurity
OpenInputDesktop
EnumDisplaySettingsW
UpdateLayeredWindow
LoadStringW
GetDesktopWindow
DispatchMessageA
wsprintfA

kernel32

GetCurrentProcess
GetCommMask
GetCurrentProcessId
GetACP
GetFileTime
GetLastError
GlobalGetAtomNameA
GetCurrentThreadId
GetCommandLineW
GetTickCount
Sleep
GetModuleHandleW
ExitProcess
PostQueuedCompletionStatus
GetCommandLineA
GetVersion
GetCurrentThread
GetModuleHandleA
EnumTimeFormatsW
WaitCommEvent
SetConsoleCP
CreateMailslotW
OpenEventA
CreateIoCompletionPort
GetProcessHeap
GetEnvironmentVariableW
VirtualAlloc
GetNamedPipeInfo

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: - Virtual size: 453KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2.9MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

818acc8541d0ab475362b95f869f0024

Headers

File Characteristics

Imports

ntdll

mtxclu

usp10

mprapi

msvcrt

user32

kernel32

Sections

.text Size: 11KB - Virtual size: 10KB

.edata Size: - Virtual size: 453KB

.idata Size: 2.9MB - Virtual size: 5.5MB

.tls Size: - Virtual size: 3KB

DATA Size: 512B - Virtual size: 24B

.rsrc Size: 99KB - Virtual size: 100KB

.text
Size: 11KB - Virtual size: 10KB

.edata
Size: - Virtual size: 453KB

.idata
Size: 2.9MB - Virtual size: 5.5MB

.tls
Size: - Virtual size: 3KB

DATA
Size: 512B - Virtual size: 24B

.rsrc
Size: 99KB - Virtual size: 100KB