JaffaCakes118_90f000259712c2faf6cd0b8bfc3b620a

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_90f000259712c2faf6cd0b8bfc3b620a
Size

251KB
MD5

90f000259712c2faf6cd0b8bfc3b620a
SHA1

329886fcfe2fb8da6917bf02f22475e21749e86a
SHA256

70d3bd7a165bcd46f8ed2e4ef2f4f4187853f10d6cd0e45d093d07bdcf817329
SHA512

86a05abf120e4394f2726f9b845e530351bb3c7aab15a7829f6cdf0f75bea38f1a92a175fd5a86a316b6262d71b4c4770a42252f557f406270a46f2d7d1eb709
SSDEEP

3072:7ES9nbDTU2g4sGC94zz7JWzGncye3ylei7EZovoq8URz3fRaZX6fnvry3dqRAefi:7ESpbDTUFETw2mnq8UR9yX6fvG3y7TTe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_90f000259712c2faf6cd0b8bfc3b620a

Files

JaffaCakes118_90f000259712c2faf6cd0b8bfc3b620a
.exe windows:4 windows x86 arch:x86

731f172583621256866c9a8daa2aa262

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoCreateInstance
CoUninitialize
OleRun
CoTaskMemFree
CoInitialize

kernel32

IsDebuggerPresent
GetLocalTime
GetProcessHeap
GetPrivateProfileStringW
GetFileSize
UnmapViewOfFile
FormatMessageW
WaitForMultipleObjects
OutputDebugStringA
DeleteFileW
SetUnhandledExceptionFilter
GetTempPathW
TlsFree
TlsGetValue
lstrcpyW
GetDateFormatW
LocalFree
LoadLibraryExW
WaitForSingleObject
EnterCriticalSection
GetPrivateProfileIntW
SetFilePointer
OpenProcess
LeaveCriticalSection
FindNextFileW
CreateFileMappingW
MapViewOfFile
FindFirstFileW
CreateMutexW
lstrcpynW
TlsSetValue
FindClose
GetCurrentThreadId
SetLastError
TlsAlloc
CloseHandle
GetModuleHandleW
lstrlenW
DeleteCriticalSection
OpenEventW
HeapFree
FreeLibrary
CreateFileW
ReadFile
CreateEventW
DeviceIoControl
UnhandledExceptionFilter
CreateProcessW
ResetEvent
WriteFile
CreateDirectoryW
GetSystemTimeAsFileTime
GetTimeFormatW
VirtualAllocEx

ws2_32

send
gethostbyname
bind
WSAEventSelect
htons
socket
WSAWaitForMultipleEvents
inet_addr
connect
htonl
ntohs
gethostname
WSAAccept
listen
closesocket
recv
WSAStartup
shutdown
WSACleanup
WSAGetLastError
WSASetEvent
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents

advapi32

SetServiceStatus
SetSecurityDescriptorDacl
BuildExplicitAccessWithNameW
SetEntriesInAclW
StartServiceCtrlDispatcherW
InitializeSecurityDescriptor
SetSecurityInfo
AdjustTokenPrivileges
OpenSCManagerW
RegCloseKey
GetSecurityInfo
DeleteService
OpenProcessToken
CloseServiceHandle
QueryServiceStatus
StartServiceW
LookupAccountSidW
OpenServiceW
RegOpenKeyExW
RegisterServiceCtrlHandlerW
GetSecurityDescriptorDacl
RegQueryValueExW
RegConnectRegistryW
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupPrivilegeValueW
CreateProcessAsUserW
CreateServiceW
ControlService
ConvertStringSidToSidW
DuplicateTokenEx
GetUserNameW
SetTokenInformation

urlmon

FindMimeFromData

user32

LoadStringW
wsprintfW

mscms

CreateProfileFromLogColorSpaceW
UnregisterCMMW
InternalGetPS2CSAFromLCS
OpenColorProfileA
InstallColorProfileW
SetColorProfileHeader

zipfldr

DllGetClassObject
RouteTheCall

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.YDee
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.yfOok
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.jRe
Size: 512B - Virtual size: 382B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xMC
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Qq
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.CrDK
Size: 512B - Virtual size: 315B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 211KB - Virtual size: 493KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aI
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

731f172583621256866c9a8daa2aa262

Headers

DLL Characteristics

File Characteristics

Imports

ole32

kernel32

ws2_32

advapi32

urlmon

user32

mscms

zipfldr

Sections

.text Size: 17KB - Virtual size: 16KB

.YDee Size: 2KB - Virtual size: 3KB

.yfOok Size: 2KB - Virtual size: 3KB

.jRe Size: 512B - Virtual size: 382B

.xMC Size: 1024B - Virtual size: 1KB

.Qq Size: 1KB - Virtual size: 2KB

.rdata Size: 3KB - Virtual size: 3KB

.CrDK Size: 512B - Virtual size: 315B

.data Size: 211KB - Virtual size: 493KB

.aI Size: 1KB - Virtual size: 2KB

.rsrc Size: 9KB - Virtual size: 9KB

.text
Size: 17KB - Virtual size: 16KB

.YDee
Size: 2KB - Virtual size: 3KB

.yfOok
Size: 2KB - Virtual size: 3KB

.jRe
Size: 512B - Virtual size: 382B

.xMC
Size: 1024B - Virtual size: 1KB

.Qq
Size: 1KB - Virtual size: 2KB

.rdata
Size: 3KB - Virtual size: 3KB

.CrDK
Size: 512B - Virtual size: 315B

.data
Size: 211KB - Virtual size: 493KB

.aI
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 9KB - Virtual size: 9KB