JaffaCakes118_d648eda9791fb495743e2c2ec2db6193

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_d648eda9791fb495743e2c2ec2db6193
Size

294KB
MD5

d648eda9791fb495743e2c2ec2db6193
SHA1

6c7f83f6ffdcefdc4253a0b122fa802bdbb542ff
SHA256

f8cbe175d1f96edaf07e641e039b445d75e769e5a2a39940b41e1c12b9e5924f
SHA512

860bd3e6bf5c447dd1ee2417ae2a9021b78590b0212c828cccf4964edbffd2566bb00b5f64ead7f821e95b8a66a3773c5ba83b2e3ee85024ef527f03d8257298
SSDEEP

6144:2aBWzLg2TGJBi3b9wMZ5RNnZghf9YF4esb5qDjaBSRMDAT3:/K4Bw++DGhfSFXswa8CDAb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_d648eda9791fb495743e2c2ec2db6193

Files

JaffaCakes118_d648eda9791fb495743e2c2ec2db6193
.exe windows:4 windows x86 arch:x86

198897a215af0d33e507072c289a7b85

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegSetValueExA
RegQueryValueExA
ImpersonateSelf
InitializeSecurityDescriptor
RegOpenKeyExA
SetSecurityDescriptorDacl
RevertToSelf
RegCloseKey

kernel32

HeapFree
DeleteCriticalSection
WaitForSingleObject
GetCurrentThreadId
GetTimeZoneInformation
GetShortPathNameA
FreeLibrary
GetCurrentDirectoryA
EnterCriticalSection
GetLocalTime
GetTempFileNameA
LeaveCriticalSection
MulDiv
GetModuleHandleA
lstrcmpiA
SystemTimeToTzSpecificLocalTime
GetTempPathA
FormatMessageA
CreateProcessA
GetCommandLineW
LocalFree
GetProcessHeap
CloseHandle
HeapAlloc
LoadLibraryExA
CreateMutexA
ReleaseMutex
OpenMutexA
WideCharToMultiByte
IsValidCodePage
VirtualAlloc

gdi32

GetNearestPaletteIndex
GetObjectW
CreateDIBitmap
CreateHalftonePalette
CreateCompatibleBitmap
DeleteObject
CreateBitmap
SelectPalette
BitBlt
GetDeviceCaps
DeleteDC
RealizePalette
GetPaletteEntries
CreateDIBSection
SetStretchBltMode
StretchDIBits
SetBkColor
SelectObject
StretchBlt
CreateCompatibleDC
ResizePalette
GetDIBits
CreatePalette

ole32

CoUninitialize
CoInitializeEx
CoCreateInstance

oleaut32

SysAllocStringByteLen
SysFreeString

shell32

ShellExecuteA
ShellExecuteExA

user32

GetDC
MessageBoxA
SendMessageA
FindWindowExW
SetForegroundWindow
GetWindowInfo
EqualRect
ReleaseDC
PostMessageA
GetSystemMetrics
GetForegroundWindow

esent

JetCreateTable
JetComputeStats
ese
JetGetLogInfoInstance
JetDupSession
JetSetSystemParameter
JetAttachDatabase
JetDBUtilities
JetGetVersion
JetBeginTransaction2
JetEnumerateColumns
JetResetCounter

kbdmon

KbdLayerDescriptor

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 251KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

198897a215af0d33e507072c289a7b85

Headers

File Characteristics

Imports

advapi32

kernel32

gdi32

ole32

oleaut32

shell32

user32

esent

kbdmon

Sections

.text Size: 22KB - Virtual size: 21KB

.data Size: 251KB - Virtual size: 1.2MB

.rdata Size: 3KB - Virtual size: 2KB

.rsrc Size: 17KB - Virtual size: 35KB

.text
Size: 22KB - Virtual size: 21KB

.data
Size: 251KB - Virtual size: 1.2MB

.rdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 17KB - Virtual size: 35KB