f6ba36edaf3b699b3656fb94131d06da_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

f6ba36edaf3b699b3656fb94131d06da_JaffaCakes118
Size

141KB
MD5

f6ba36edaf3b699b3656fb94131d06da
SHA1

9dc88694e0f4be51cc4c6b435349f3939e6b0a47
SHA256

939599e255f0c6092afd1b747b0b8d4734ab1218be51708c395151f69da19e39
SHA512

c70e3cba46c8d75db05db5d4b8461ce7d3d1087d56ac635f856a9b26f85152ba465653944acb7bfe87edb5b978fc45d9c462c2f61461e4efe36e9f607fb0b6b6
SSDEEP

3072:K5yJGaBDcKFP/QCtxydMKNWUWFisaGJC:K59aBwC/QrAfaGw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
f6ba36edaf3b699b3656fb94131d06da_JaffaCakes118

Files

f6ba36edaf3b699b3656fb94131d06da_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fd13a0b1442083ef8dd5bdba75a1ea04

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

AddAtomA
CreateEventA
CreateProcessA
DeleteCriticalSection
DeleteFileA
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExitProcess
ExitThread
FileTimeToLocalFileTime
FormatMessageA
FreeLibrary
GetConsoleCP
GetConsoleOutputCP
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetEnvironmentStringsA
GetExitCodeProcess
GetModuleFileNameA
GetPrivateProfileStringA
GetProcAddress
GetProcessHeap
GetStdHandle
GetSystemInfo
GetThreadLocale
GetVersion
GlobalAlloc
GlobalFree
GlobalUnlock
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InterlockedExchange
InterlockedIncrement
IsBadWritePtr
IsValidLocale
LCMapStringA
LeaveCriticalSection
LoadLibraryA
LoadResource
LocalFree
Module32Next
OpenEventA
OpenProcess
QueryPerformanceCounter
ReadFile
ReleaseMutex
SetEnvironmentVariableA
SetEvent
SetPriorityClass
SizeofResource
Sleep
UnhandledExceptionFilter
UnmapViewOfFile
VirtualFree
WideCharToMultiByte
WriteConsoleA
lstrcmpA
lstrlenA

user32

CreateWindowExA
DrawFocusRect
EndDialog
GetDesktopWindow
IsRectEmpty
LoadStringA
SetRect
SetTimer
TranslateMessage

advapi32

CloseServiceHandle
ControlService
EqualSid
RegCreateKeyExA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
RegFlushKey
RegQueryInfoKeyA
RegisterServiceCtrlHandlerA
StartServiceA

Sections

.text
Size: 90KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.DATA
Size: 37KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd13a0b1442083ef8dd5bdba75a1ea04

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Sections

.text Size: 90KB - Virtual size: 92KB

.DATA Size: 37KB - Virtual size: 172KB

.data Size: 6KB - Virtual size: 8KB

.idata Size: 2KB - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.rsrc Size: 3KB - Virtual size: 3KB

.text
Size: 90KB - Virtual size: 92KB

.DATA
Size: 37KB - Virtual size: 172KB

.data
Size: 6KB - Virtual size: 8KB

.idata
Size: 2KB - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.rsrc
Size: 3KB - Virtual size: 3KB