JaffaCakes118_6adfcb0b4ff8cb38a1e7c8b236910c09

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_6adfcb0b4ff8cb38a1e7c8b236910c09
Size

588KB
MD5

6adfcb0b4ff8cb38a1e7c8b236910c09
SHA1

e770e797646fa67ef82a48c6d0100e9f5b2bb852
SHA256

5a7e6c4c22f0fc8fc5cd1346a89c587835a2346ea95f5b7c6ee857f13b1050bd
SHA512

214c7b12bcd0033a155fbbc873573bd42f000f37785f2c08feefd30e086cbd0ae0b954ea935c3b03f233f8f99d861c57cd03ab12002cd09a18fac8406024eeb1
SSDEEP

12288:MIH5S8pw6ugAhqZpRjjiOPVZFwydnXQ4iqyAxUelg0qv1uDju+4hXG77ttGpNo9J:MIH5ZuXsZpRSOdZ+yd/iqtDg0qv1AjuG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_6adfcb0b4ff8cb38a1e7c8b236910c09

Files

JaffaCakes118_6adfcb0b4ff8cb38a1e7c8b236910c09
.exe windows:6 windows x86 arch:x86

ea642d8cbc343135077188bff92863e2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

logman.pdb

Imports

advapi32

ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
OpenThreadToken
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
SetSecurityDescriptorGroup
GetSecurityDescriptorGroup
SetSecurityDescriptorOwner
GetSecurityDescriptorOwner
InitializeSecurityDescriptor
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

kernel32

GetCurrentProcess
GetLastError
GetCurrentThread
SystemTimeToFileTime
GetFullPathNameW
GetCurrentDirectoryW
GlobalLock
GetProcessHeap
GlobalFree
GlobalUnlock
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceW
ReadConsoleW
MultiByteToWideChar
GetFileType
ReadFile
SetConsoleMode
GetConsoleMode
GetStdHandle
LocalFree
SetFilePointerEx
CreateFileW
HeapSetInformation
InterlockedExchange
HeapFree
HeapAlloc
CloseHandle
GlobalAlloc
SearchPathW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
UnmapViewOfFile
GetVersionExW
CreateFileMappingW
MapViewOfFile
LoadLibraryExW
SetLastError
FindResourceExW
FindFirstFileW
FindNextFileW
FindClose
LoadLibraryW
FreeLibrary
FormatMessageW
WriteFile
WriteConsoleW
GetConsoleOutputCP
SetThreadUILanguage
GetConsoleScreenBufferInfo
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
GetLocaleInfoW
GetModuleFileNameW
ExpandEnvironmentStringsW
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
InterlockedCompareExchange
SetUnhandledExceptionFilter
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
Sleep

msvcrt

_vsnwprintf
_wcsicmp
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
qsort
_wtoi
towlower
wcsstr
wcschr
_wfopen
_errno
fgetws
ferror
wcsrchr
fseek
fclose
_getmbcp
wprintf
memset
iswspace
_wmakepath_s
_wsplitpath_s
wcsncmp
_wcsnicmp
bsearch
memcpy
wcstok
isspace

user32

LoadStringW
CharToOemW

ole32

CoInitializeEx
CoUninitialize
CoInitializeSecurity
CoCreateInstance
CreateStreamOnHGlobal
StringFromGUID2

oleaut32

VarDateFromStr
VariantTimeToSystemTime
VariantClear
VariantInit
SystemTimeToVariantTime
SafeArrayDestroy
SafeArrayUnaccessData
SysAllocString
SafeArrayAccessData
SafeArrayCreateVector
SysFreeString
VariantChangeType
VarBstrFromDate

shlwapi

PathIsNetworkPathW

secur32

GetUserNameExW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

ntdll

NtOpenProcessToken
NtClose
NtQueryInformationToken
NtOpenThreadToken

Sections

.text
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp0
Size: 508KB - Virtual size: 1.6MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ea642d8cbc343135077188bff92863e2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

user32

ole32

oleaut32

shlwapi

secur32

version

ntdll

Sections

.text Size: 65KB - Virtual size: 64KB

.data Size: 7KB - Virtual size: 8KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 5KB - Virtual size: 5KB

.vmp0 Size: 508KB - Virtual size: 1.6MB

.text
Size: 65KB - Virtual size: 64KB

.data
Size: 7KB - Virtual size: 8KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 5KB - Virtual size: 5KB

.vmp0
Size: 508KB - Virtual size: 1.6MB