35320119bdf9b8953c68ffd5fd55a986_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

35320119bdf9b8953c68ffd5fd55a986_JaffaCakes118
Size

285KB
MD5

35320119bdf9b8953c68ffd5fd55a986
SHA1

832af2ba23d8c3dd725a9e6ad542e6118ed29dc6
SHA256

e4a62b2f18d22b58a104c2976e2e5104606e470a064bdf7d0bb2b0e9aba84bf9
SHA512

f029ea1f6ace487bb6ad4ecdbb92f8c86effd4c77c3fa8440e3f0bd786d6bcbcb54acc08bb51ff1e1ee34a5209c5008e0fef7868fec7520f90a3432452d25dd7
SSDEEP

6144:IkgmBi2yls2Yt8QFRpRaoI5/HJ1W97A4ck7g1Ok3rswn2fexNtqoWGDgE62W4oNf:IkgmBi2yls2YtInFTqoWGDgE62ucv25Z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
35320119bdf9b8953c68ffd5fd55a986_JaffaCakes118

Files

35320119bdf9b8953c68ffd5fd55a986_JaffaCakes118
.exe windows:5 windows x86 arch:x86

c316e6553a0c0481d6fa9735adea5ab6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

_encoded_null
_decode_pointer
__FrameUnwindFilter
_amsg_exit
??0exception@std@@QAE@ABV01@@Z
?what@exception@std@@UBEPBDXZ
??3@YAXPAX@Z
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_encode_pointer
_crt_debugger_hook
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
malloc
__CxxRegisterExceptionObject
printf
??_V@YAXPAX@Z
__CxxExceptionFilter
__CxxUnregisterExceptionObject
_CxxThrowException
__CxxDetectRethrow
__CxxQueryExceptionSize
??2@YAPAXI@Z
_cexit

kernel32

SetUnhandledExceptionFilter
IsDebuggerPresent
GetFileSize
FindResourceExW
CreateProcessW
OutputDebugStringW
GetTickCount
ExpandEnvironmentStringsA
UnhandledExceptionFilter
GetFirmwareEnvironmentVariableA
LoadLibraryW
FatalAppExitW
GetFileAttributesW
CreateFileW
lstrcatA
GetStartupInfoA
GetProcessVersion
GetPrivateProfileSectionNamesA
VirtualProtect
SetProcessShutdownParameters
lstrcpyA
Sleep
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetCurrentProcess
TerminateProcess
GlobalAlloc

user32

AdjustWindowRect
SetWindowContextHelpId
AnyPopup

gdi32

CloseFigure
CreateEllipticRgn
CreateDIBPatternBrush
AbortPath
CreateDCW
EndPath
FillPath
CombineRgn

advapi32

RegSetValueExW

shell32

DragQueryPoint

winhttp

WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpOpen

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ

msvcm90

?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@P$AAVException@3@@Z
?DoDllLanguageSupportValidation@<CrtImplementationDetails>@@YAXXZ
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@@Z
?ThrowNestedModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVException@System@@0@Z
?DoCallBackInDefaultDomain@<CrtImplementationDetails>@@YAXP6GJPAX@Z0@Z
?RegisterModuleUninitializer@<CrtImplementationDetails>@@YAXP$AAVEventHandler@System@@@Z

mscoree

_CorExeMain

Sections

.text
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 232KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c316e6553a0c0481d6fa9735adea5ab6

Headers

DLL Characteristics

File Characteristics

Imports

msvcr90

kernel32

user32

gdi32

advapi32

shell32

winhttp

msvcp90

msvcm90

mscoree

Sections

.text Size: 51KB - Virtual size: 50KB

.data Size: 512B - Virtual size: 6KB

.rsrc Size: 232KB - Virtual size: 232KB

.text
Size: 51KB - Virtual size: 50KB

.data
Size: 512B - Virtual size: 6KB

.rsrc
Size: 232KB - Virtual size: 232KB