3474f0408fd4f7d245d3a5acdb794b66_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

3474f0408fd4f7d245d3a5acdb794b66_JaffaCakes118
Size

459KB
MD5

3474f0408fd4f7d245d3a5acdb794b66
SHA1

1f1fcd5e8cf4bf5a35f4d9920408f7d67f37382c
SHA256

4c3338ae8b9ddaf46d76f44ad4cf5ecf2b46e4d189139f6fd8fe9fecee097cbd
SHA512

2678711fc6888940b0793b875ea7e5b3fd45832bfe47b003e9a8291ba1469dd69a32f9d05547ec2d1a6592068daf0987d12c62943ffb0a01e191760f28c204b6
SSDEEP

12288:VQFtH1b0F7YGLGljH7/hBJZWIQDAAJNAZ8r:P+HljH7flQxNA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
3474f0408fd4f7d245d3a5acdb794b66_JaffaCakes118

Files

3474f0408fd4f7d245d3a5acdb794b66_JaffaCakes118
.exe windows:6 windows x86 arch:x86

00fc1b572a46fdf77e7e36b100586846

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\danger\verb\History\Boat\anyany.pdb

Imports

kernel32

EnterCriticalSection
VirtualFree
GetCommandLineW
SetSystemPowerState
GetCPInfo
VirtualAlloc
InitializeCriticalSection
GetTempPathW
VirtualProtect
ResetEvent
HeapAlloc
GetCurrentDirectoryW
VirtualProtectEx
GetProcessHeap
GetModuleHandleW
CopyFileW
GetSystemTimeAsFileTime
Sleep
DecodePointer
ReadConsoleW
ReadFile
SetEndOfFile
CreateFileW
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
EncodePointer
RaiseException
RtlUnwind
GetLastError
GetModuleFileNameW
FreeLibrary
LoadLibraryExW
GetModuleFileNameA
GetModuleHandleExW
HeapValidate
GetSystemInfo
GetStdHandle
WriteFile
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetACP
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
CloseHandle
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetTimeZoneInformation
GetStringTypeW
OutputDebugStringA
OutputDebugStringW
WriteConsoleW
WaitForSingleObjectEx
CreateThread
HeapFree
HeapReAlloc
HeapSize
HeapQueryInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
SetFilePointerEx
CreateDirectoryW

ole32

CoUninitialize
CoInitialize
CoCreateInstance

shlwapi

PathRenameExtensionW

advapi32

SystemFunction036

Sections

.text
Size: 349KB - Virtual size: 348KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

00fc1b572a46fdf77e7e36b100586846

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ole32

shlwapi

advapi32

Sections

.text Size: 349KB - Virtual size: 348KB

.rdata Size: 92KB - Virtual size: 92KB

.data Size: 15KB - Virtual size: 71KB

.gfids Size: 512B - Virtual size: 320B

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 349KB - Virtual size: 348KB

.rdata
Size: 92KB - Virtual size: 92KB

.data
Size: 15KB - Virtual size: 71KB

.gfids
Size: 512B - Virtual size: 320B

.rsrc
Size: 1KB - Virtual size: 1KB