bfd38964ce5ed7eb0298112762d73661_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

bfd38964ce5ed7eb0298112762d73661_JaffaCakes118
Size

378KB
MD5

bfd38964ce5ed7eb0298112762d73661
SHA1

f44f6c31834a5e615b35a79e34c8396f31a440d3
SHA256

e3e6b0c7c76f1e07644749b4666f7c24bb9f061a9b9d0413623281d141cfa32f
SHA512

4883083f628d89e5a41a847df4c84983b1e6779ba7f0176a70c6ce84b7dc0867362ab2296e8bb108018599e6b14a540a46d69ad3400c8aa0a0db8ccf4fff65e2
SSDEEP

6144:YtojtTr+jbe26iPrJ0gDn2ykShB9uh1NeCx5CmkxIGgz2na6Ja:YtojxK3SQ0jS8LNeCx5PGgz2ah

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bfd38964ce5ed7eb0298112762d73661_JaffaCakes118

Files

bfd38964ce5ed7eb0298112762d73661_JaffaCakes118
.exe windows:5 windows x86 arch:x86

baf5c2110fa8a268441421686d4e3331

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\lurugiboregepi tinoferizoj\xif\porucozow\lisicacax_xazuk.pdb

Imports

kernel32

ExitProcess
CreateTimerQueue
SearchPathW
InterlockedIncrement
GetProcessPriorityBoost
GetTickCount
GenerateConsoleCtrlEvent
IsBadReadPtr
GetConsoleAliasesLengthA
CreateActCtxW
GlobalAlloc
SetFileShortNameW
GetSystemTimeAdjustment
GetVersionExW
GetModuleFileNameW
GetEnvironmentVariableA
lstrlenW
GetStartupInfoW
FindFirstFileExA
SetLastError
GetProcAddress
GetLongPathNameA
CopyFileA
CreateMemoryResourceNotification
_hwrite
OpenWaitableTimerA
OpenMutexA
ProcessIdToSessionId
RegisterWaitForSingleObject
OpenWaitableTimerW
MoveFileA
SetConsoleOutputCP
SetCurrentDirectoryW
WriteProfileSectionW
AddAtomA
GetModuleHandleA
GetProcessShutdownParameters
FreeEnvironmentStringsW
GetCurrentDirectoryA
CompareStringA
GetFileTime
OutputDebugStringA
GetVersionExA
GetWindowsDirectoryW
DeleteTimerQueueTimer
AddConsoleAliasA
DeleteFileA
CloseHandle
CreateFileW
SetStdHandle
RaiseException
GetCommandLineW
HeapSetInformation
DecodePointer
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
InterlockedDecrement
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
GetCurrentThreadId
TlsFree
GetModuleHandleW
GetLastError
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapValidate
HeapCreate
WriteFile
GetStringTypeW
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
WriteConsoleW
OutputDebugStringW
LoadLibraryW
RtlUnwind
WideCharToMultiByte
LCMapStringW
HeapAlloc
GetModuleFileNameA
HeapReAlloc
HeapSize
HeapQueryInformation
HeapFree
IsProcessorFeaturePresent
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers

user32

GetComboBoxInfo

winhttp

WinHttpQueryOption

Sections

.text
Size: 296KB - Virtual size: 296KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 18.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

baf5c2110fa8a268441421686d4e3331

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

winhttp

Sections

.text Size: 296KB - Virtual size: 296KB

.data Size: 7KB - Virtual size: 18.4MB

.rsrc Size: 15KB - Virtual size: 15KB

.reloc Size: 58KB - Virtual size: 58KB

.text
Size: 296KB - Virtual size: 296KB

.data
Size: 7KB - Virtual size: 18.4MB

.rsrc
Size: 15KB - Virtual size: 15KB

.reloc
Size: 58KB - Virtual size: 58KB