39522c4df791e8db12bfc8a9ba8c424a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

39522c4df791e8db12bfc8a9ba8c424a_JaffaCakes118
Size

27KB
MD5

39522c4df791e8db12bfc8a9ba8c424a
SHA1

e30a68b039e64fae0525381f8d2f807e09aaec55
SHA256

f2b1d28b3c7988a38392a91a5c814904f8e5c5fed74b230d7af4d767229e4762
SHA512

721f5a26368ff30cb11e6c89d00ea5016f7eb12dd37f20824d091b20e650196773671f8e333b044c293abb819dad57a6f9e04f71142a4cc3316e10d4a2a3bf9c
SSDEEP

768:0VqI5mTXlPPGuhg2UaJhtMK61gXVlzKysE7D04F:SqUcAu+6J/lzKyDF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
39522c4df791e8db12bfc8a9ba8c424a_JaffaCakes118

Files

39522c4df791e8db12bfc8a9ba8c424a_JaffaCakes118
.exe windows:10 windows x86 arch:x86

f4bf2a956f42feedf0735854ec658e0d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

advapi32

EventWrite

gdi32

BitBlt

user32

GetDC

msvcrt

free

comctl32

ord329

shell32

ord100

shlwapi

ord388

api-ms-win-core-com-l1-1-0

CoTaskMemFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetProcessId

api-ms-win-core-errorhandling-l1-1-0

GetLastError

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount

api-ms-win-core-synch-l1-1-0

SetEvent

api-ms-win-core-heap-l1-1-0

HeapFree

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-io-l1-1-0

CreateIoCompletionPort

api-ms-win-core-path-l1-1-0

PathCchAppend

api-ms-win-eventing-provider-l1-1-0

EventEnabled

api-ms-win-core-winrt-l1-1-0

RoActivateInstance

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString

api-ms-win-core-string-l2-1-0

CharLowerW

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-eventing-controller-l1-1-0

StopTraceW

api-ms-win-core-file-l1-1-0

DeleteFileW

ntdll

RtlNtStatusToDosError

ole32

CoInitialize

Sections

.MPRESS1
Size: 18KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f4bf2a956f42feedf0735854ec658e0d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

gdi32

user32

msvcrt

comctl32

shell32

shlwapi

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-eventing-controller-l1-1-0

api-ms-win-core-file-l1-1-0

ntdll

ole32

Sections

.MPRESS1 Size: 18KB - Virtual size: 56KB

.MPRESS2 Size: 5KB - Virtual size: 5KB

.rsrc Size: 3KB - Virtual size: 3KB

.MPRESS1
Size: 18KB - Virtual size: 56KB

.MPRESS2
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 3KB - Virtual size: 3KB