JaffaCakes118_6de4d2fd080960344ac8fac697c85556

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_6de4d2fd080960344ac8fac697c85556
Size

1.3MB
MD5

6de4d2fd080960344ac8fac697c85556
SHA1

272641430e0ca1ac66c8d8e15280ef447fb89e44
SHA256

abf442d8112f2a624cdbaa8a90ba2f91f9776abbc6ee0d952de33e79e5548e9a
SHA512

55da3f1315fd6f62296d6d1b8fef3e1e509adf8be8aa0fd09aaa0afe47d483687492310c3b92af8f4407ccab6344379f438b65cf88aba2d31cf464b1a8a154c7
SSDEEP

24576:uPFi9XiWl8dg0mEx24J302pd34dBp2DPP4TWdYwjRUwMRLP82gI+xzcTKUJLFF:4i9XiNN4dBuPgTxwjRUlF5WxzstL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_6de4d2fd080960344ac8fac697c85556

Files

JaffaCakes118_6de4d2fd080960344ac8fac697c85556
.exe windows:5 windows x86 arch:x86

3429a39fc09a8fbca9f38ef344467168

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\SVN\mbam\support\killer\mbam-killer.exe\build\mbam-killer.pdb

Imports

user32

CharUpperA
CharLowerW
GetSystemMetrics
CharUpperW

shell32

SHGetFolderPathW

advapi32

ImpersonateLoggedOnUser
ControlService
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
GetUserNameW
RegOpenCurrentUser
RegEnumKeyExW
RegSetValueExW
StartServiceW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
CryptHashData
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptGenRandom
CryptDeriveKey
CryptAcquireContextW
CryptGetHashParam
FreeSid
SetEntriesInAclW
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueW
RegEnumValueW
RegQueryInfoKeyW
IsTextUnicode
RevertToSelf

kernel32

FindFirstFileW
GetCurrentProcess
GetSystemWindowsDirectoryW
FindClose
FindNextFileW
GetWindowsDirectoryW
ExpandEnvironmentStringsW
GetTickCount
CompareFileTime
GetSystemTimeAsFileTime
GetFileTime
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
GetStringTypeW
Sleep
GetCommandLineW
HeapSetInformation
GetLastError
HeapFree
HeapReAlloc
RaiseException
GetCPInfo
RtlUnwind
HeapAlloc
LCMapStringW
CompareStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetLongPathNameW
SetHandleCount
GetFileType
GetStartupInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
IsProcessorFeaturePresent
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
GetSystemInfo
IsValidLocale
HeapSize
FreeLibrary
LoadLibraryW
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleW
ReadFile
GetVersionExW
GetComputerNameW
InitializeCriticalSectionAndSpinCount
DeviceIoControl
SetEnvironmentVariableA
GetFileAttributesExW
GetShortPathNameW
GetFileSizeEx
LocalFree
FileTimeToLocalFileTime
GetTimeZoneInformation
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
BackupRead
FlushFileBuffers
BackupSeek
SetThreadExecutionState
DeleteFileW
CreateFileW
GetFileAttributesW
GetSystemDirectoryW
GetSystemTime
CloseHandle
Module32NextW
CreateToolhelp32Snapshot
Process32NextW
Module32FirstW
Process32FirstW
GetProcAddress
TerminateProcess
OpenProcess
GetModuleHandleW
WaitForSingleObject
CreateProcessW
GetVolumeInformationW
CreateDirectoryW
FindResourceW
LoadResource
SizeofResource
GetEnvironmentStringsW
EnumSystemLocalesA
GetTempPathW
GetDateFormatW
SystemTimeToFileTime
GetTimeFormatW
FileTimeToSystemTime
LockResource

shlwapi

SHRegGetPathW

userenv

GetUserProfileDirectoryW
ExpandEnvironmentStringsForUserW
GetDefaultUserProfileDirectoryW
GetProfilesDirectoryW

mpr

WNetGetConnectionW

psapi

GetModuleFileNameExW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wintrust

WinVerifyTrust

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW

Sections

.text
Size: 673KB - Virtual size: 672KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 504B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp0
Size: 500KB - Virtual size: 1.6MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3429a39fc09a8fbca9f38ef344467168

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

shell32

advapi32

kernel32

shlwapi

userenv

mpr

psapi

version

wintrust

wtsapi32

Sections

.text Size: 673KB - Virtual size: 672KB

.rdata Size: 136KB - Virtual size: 135KB

.data Size: 15KB - Virtual size: 24KB

.rsrc Size: 512B - Virtual size: 504B

.reloc Size: 43KB - Virtual size: 42KB

.vmp0 Size: 500KB - Virtual size: 1.6MB

.text
Size: 673KB - Virtual size: 672KB

.rdata
Size: 136KB - Virtual size: 135KB

.data
Size: 15KB - Virtual size: 24KB

.rsrc
Size: 512B - Virtual size: 504B

.reloc
Size: 43KB - Virtual size: 42KB

.vmp0
Size: 500KB - Virtual size: 1.6MB