edbb307205339cd70debb64804bc537f_JaffaCakes118

General

Target

edbb307205339cd70debb64804bc537f_JaffaCakes118
Size

363KB
MD5

edbb307205339cd70debb64804bc537f
SHA1

33f8432e49a12fa06835ca1178429b0db93de79f
SHA256

7077479a6f60eb771de464486257dc1284b64f5141da13e59ccc2e3adf33c581
SHA512

44d4033766354fa5f5a89a0eae7c7875ba720bdeea0c1efa8b6eb1792db763e5befcdcd063d7e88fbf41213f58de1941f45c15edef13a4835555d95a7f924ca8
SSDEEP

6144:xH1YJJIaFipHIFx9hbwIFCAZHI2oHU6b3UE66VtdRTYrjNNr6H1I7wRnK8548FFt:DYJepobrwIAco2ub+6VlYrjTM1fp88my

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
edbb307205339cd70debb64804bc537f_JaffaCakes118

Files

edbb307205339cd70debb64804bc537f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2c2f2bd9bde3502eddf4e691901503df

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ResetEvent
WriteFile
GetLocalTime
LoadLibraryA
GetModuleFileNameA
GetCurrentThread
SystemTimeToFileTime
SetEvent
InterlockedIncrement
TlsGetValue
InterlockedDecrement
FreeLibraryAndExitThread
WaitForSingleObject
CreateThread
CreateEventA
GetCurrentProcess
GetLocaleInfoA
GetStringTypeW
TlsSetValue
VirtualProtect
CloseHandle
GetCommandLineA
GetStringTypeA
LCMapStringW
MultiByteToWideChar
RtlUnwind
GetModuleHandleA
GetStartupInfoA
GetVersionExA
InterlockedExchange
VirtualQuery
ExitProcess
GetProcAddress
TerminateProcess
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
VirtualAlloc
HeapReAlloc
HeapSize
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
GetSystemInfo

user32

wvsprintfA

advapi32

OpenThreadToken
DuplicateTokenEx
OpenProcessToken

rpcrt4

RpcAsyncInitializeHandle
RpcAsyncCompleteCall

Sections

.text
Size: 349KB - Virtual size: 349KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 325KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2c2f2bd9bde3502eddf4e691901503df

Headers

File Characteristics

Imports

kernel32

user32

advapi32

rpcrt4

Sections

.text Size: 349KB - Virtual size: 349KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 4KB - Virtual size: 325KB

.rsrc Size: 3KB - Virtual size: 3KB

.text
Size: 349KB - Virtual size: 349KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 4KB - Virtual size: 325KB

.rsrc
Size: 3KB - Virtual size: 3KB