fda7213d395e5be45054af5733c1911a_JaffaCakes118

General

Target

fda7213d395e5be45054af5733c1911a_JaffaCakes118
Size

283KB
MD5

fda7213d395e5be45054af5733c1911a
SHA1

cd19c9cbc652b082e3c535ce87329b30bb03f798
SHA256

88e57cfa298c317008f71f032b908c12680efca76beaaa6b78603f477ae85fef
SHA512

8191e009013488bee1547cf726907dcd339130170f00b6cdf1cd8a88865dd94d70ac09cddd92530923affa672306083a3a5f7795f51a5f34cf13e7adbce2d00d
SSDEEP

6144:HyA26TDSbyAf69YMzainA/zcorVGUV3+anGGu14:ppDSbJf69YMzayuBDV3xGF4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fda7213d395e5be45054af5733c1911a_JaffaCakes118

Files

fda7213d395e5be45054af5733c1911a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d41a9b2aa381390197ba50e53fd4e3ac

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

iphlpapi

GetIpAddrTable

setupapi

CM_Get_Parent
CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status

shell32

SHGetFolderPathW

kernel32

VirtualAlloc
GetEnvironmentStrings
WriteFile
GetACP
AddAtomA
SetLastError
FreeEnvironmentStringsW
GetStartupInfoA
GetCPInfo
IsBadWritePtr
GetFileType
GetCurrentProcess
VirtualFree
TlsFree
TlsGetValue
GetVersionExA
FreeEnvironmentStringsA
EnumResourceLanguagesA
QueryPerformanceCounter
GetOEMCP
SetHandleCount
HeapDestroy
TerminateProcess
VirtualQuery
lstrcpyW
TlsSetValue
GetEnvironmentStringsW
InterlockedExchange
GetStdHandle
GetSystemInfo
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetLocaleInfoA
HeapSize
UnhandledExceptionFilter
TlsAlloc
HeapCreate
SetEndOfFile
SetUnhandledExceptionFilter

newdev

UpdateDriverForPlugAndPlayDevicesW

user32

EnumChildWindows
IsWindow
DestroyWindow
SendMessageA
GetDlgItem
CreateWindowExW
GetWindowThreadProcessId

mprapi

MprConfigServerDisconnect
MprConfigServerConnect
MprConfigGetFriendlyName

Sections

.text
Size: 145KB - Virtual size: 277KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d41a9b2aa381390197ba50e53fd4e3ac

Headers

File Characteristics

Imports

iphlpapi

setupapi

shell32

kernel32

newdev

user32

mprapi

Sections

.text Size: 145KB - Virtual size: 277KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 134KB - Virtual size: 133KB

.rsrc Size: 512B - Virtual size: 4KB

.text
Size: 145KB - Virtual size: 277KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 134KB - Virtual size: 133KB

.rsrc
Size: 512B - Virtual size: 4KB