2902917c57c91966f706c2d786597e50_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2902917c57c91966f706c2d786597e50_JaffaCakes118
Size

19KB
MD5

2902917c57c91966f706c2d786597e50
SHA1

2b3c30e08f8bced42a8dfec0d51d1db1f6d04d24
SHA256

4f09e610394596c413a76c787fd2e4761092d9f89d344633e0cf59fcf91bf760
SHA512

2bbb066f582abf211b59b44000a7294780df70599cdc6097947c7ce3c7df904fcc9a1d6d319f29f628b57bdbe1f4a572467bce7adb9cefd7f99573b997768888
SSDEEP

384:ONTX5C6iPHDmiXGkSbg/TUnQirCE7YxTS+AI1XDNuYpSZWPSWI6:ONo6Q9XGRbg7UNATMGxudec6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2902917c57c91966f706c2d786597e50_JaffaCakes118

Files

2902917c57c91966f706c2d786597e50_JaffaCakes118
.exe windows:10 windows x86 arch:x86

53b1feec1a1681bb8c95e840728510fb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

msvcrt

exit

api-ms-win-core-heap-l1-1-0

HeapFree

api-ms-win-core-errorhandling-l1-1-0

GetErrorMode

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-core-com-l1-1-0

IIDFromString

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-synch-l1-1-0

SetEvent

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

TlsGetValue

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

api-ms-win-core-debug-l1-1-0

DebugBreak

api-ms-win-appmodel-runtime-l1-1-2

AppPolicyGetMediaFoundationCodecLoading

mfcore

MFCreatePMPHost

mfplat

MFStartup

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.MPRESS1
Size: 13KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

53b1feec1a1681bb8c95e840728510fb

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-appmodel-runtime-l1-1-2

mfcore

mfplat

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.MPRESS1 Size: 13KB - Virtual size: 44KB

.MPRESS2 Size: 3KB - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 2KB

.MPRESS1
Size: 13KB - Virtual size: 44KB

.MPRESS2
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 2KB