2d6709d2c3626c62f0bcd11c2ce45ebd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2d6709d2c3626c62f0bcd11c2ce45ebd_JaffaCakes118
Size

529KB
MD5

2d6709d2c3626c62f0bcd11c2ce45ebd
SHA1

d929f328caa3e3ede0f5d9ccac102c7dbf41215b
SHA256

6217d81542fa81be4ac03f16b9d14ec0f0622818d096e4e49db0940a41e668cf
SHA512

37cfc1cd0ec8b9ae54aa58da227a0e1c44edfbfb48a8e570e179153963e8284b2d63fbc91368cc0ef70f6b877eff0d2af3b97f5d9884b74f243628e76b625dce
SSDEEP

12288:hLffr2Ml4HvOFsY8BY3aqWtRd26qfcu6AC/:pfKLYse3iwfqn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2d6709d2c3626c62f0bcd11c2ce45ebd_JaffaCakes118

Files

2d6709d2c3626c62f0bcd11c2ce45ebd_JaffaCakes118
.exe windows:5 windows x86 arch:x86

35806d819a4cb49ae0c3b4f6c1b62151

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Good Gold\Desktop\stub0b\HEXCALC\Release\HEXCALC.pdb

Imports

kernel32

Sleep
HeapReAlloc
HeapSize
GetStringTypeW
MultiByteToWideChar
RtlUnwind
HeapFree
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
DeleteCriticalSection
LCMapStringW
WriteFile
HeapAlloc
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameW
HeapCreate
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
IsProcessorFeaturePresent

user32

EndPaint
DestroyWindow
GetMessageW
PostQuitMessage
FillRect
LoadCursorW
MessageBeep
SetFocus
BeginPaint
wsprintfW
TranslateMessage
LoadIconW
GetDlgItem
CharUpperW
ShowWindow
CreateDialogParamW
RegisterClassW
GetSystemMetrics
SetDlgItemTextW
SendMessageW
DefWindowProcW
DispatchMessageW
MessageBoxW

gdi32

CreateSolidBrush
DeleteObject

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 456KB - Virtual size: 459KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

35806d819a4cb49ae0c3b4f6c1b62151

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

Sections

.text Size: 20KB - Virtual size: 19KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 456KB - Virtual size: 459KB

.rsrc Size: 35KB - Virtual size: 35KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 20KB - Virtual size: 19KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 456KB - Virtual size: 459KB

.rsrc
Size: 35KB - Virtual size: 35KB

.reloc
Size: 5KB - Virtual size: 5KB