0611ec32aebf29e303d8a49ff55519b6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0611ec32aebf29e303d8a49ff55519b6_JaffaCakes118
Size

248KB
MD5

0611ec32aebf29e303d8a49ff55519b6
SHA1

ea309c5a36f50c0da173d1ddc92f44a6be9d4dc3
SHA256

8a49a642107432681ce599dc9422156a29076a2f77e34c29f6e60c95be390cfc
SHA512

4073e7f536538293f99786fd506a77b636043e2991b5d77810bef3e98e626c383bc51fa05906973c88ac35c84178a226eeef8ca7a51160951fb5557fc81e21a2
SSDEEP

6144:Or3529M1kD9cvq40Y4HG/Nrtk/kG6nsTLcte:w4Qk5PmtK/R0mcte

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0611ec32aebf29e303d8a49ff55519b6_JaffaCakes118

Files

0611ec32aebf29e303d8a49ff55519b6_JaffaCakes118
.exe windows:5 windows x86 arch:x86

7e53b405b436d0182c746a67e8151655

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
SetThreadContext
FlushFileBuffers
SetFileShortNameW
GetTickCount
CreateMailslotA
MapViewOfFile
FlushViewOfFile
GetModuleFileNameA
GlobalAlloc
WriteProfileSectionA
SetVolumeMountPointA
SetConsoleMode
SetConsoleCP
GetConsoleOutputCP
GetStringTypeW
OutputDebugStringW
WriteConsoleW
SetFilePointerEx
GetModuleHandleW
GetProcAddress
SetStdHandle
HeapReAlloc
GetCPInfo
GetOEMCP
EncodePointer
DecodePointer
RaiseException
RtlUnwind
GetCommandLineW
IsProcessorFeaturePresent
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
HeapSize
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
CloseHandle
WriteFile
GetConsoleCP
GetConsoleMode
DeleteCriticalSection
SetLastError
GetCurrentThreadId
GetProcessHeap
GetStdHandle
GetFileType
GetStartupInfoW
GetModuleFileNameW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LCMapStringW
LoadLibraryExW
IsValidCodePage
GetACP
CreateFileW

user32

GetMenuStringA
SetPropA
GetMenuInfo

advapi32

ReportEventA

ole32

CoGetCurrentProcess

msimg32

TransparentBlt

Sections

.text
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 7.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 158KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7e53b405b436d0182c746a67e8151655

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

msimg32

Sections

.text Size: 51KB - Virtual size: 51KB

.rdata Size: 26KB - Virtual size: 25KB

.data Size: 6KB - Virtual size: 7.1MB

.rsrc Size: 158KB - Virtual size: 158KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 51KB - Virtual size: 51KB

.rdata
Size: 26KB - Virtual size: 25KB

.data
Size: 6KB - Virtual size: 7.1MB

.rsrc
Size: 158KB - Virtual size: 158KB

.reloc
Size: 4KB - Virtual size: 4KB