6f17cb8af257bb7c6615e816bbf6fadb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6f17cb8af257bb7c6615e816bbf6fadb_JaffaCakes118
Size

455KB
MD5

6f17cb8af257bb7c6615e816bbf6fadb
SHA1

7fe7b570aac962992d5815bc41421e0f2b6b90fc
SHA256

7bbc9037261d07deaf8f6ca83345e679cd105ddb62361482e73a2f53f23f182f
SHA512

f1631db833c9b14ee28b55381a1e9900d4da320fb6886c5925f8523dedb37a898340054b1cc0ecb0601bcf94dc3e06bd0903e1be61a2aab0c81eababcf2f9b43
SSDEEP

6144:pk69oa2DnZot8e/toa/YhFdBtH9dXfZNJIYb9eHg1jgw:pF72DnOt1N4H9dXRgw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6f17cb8af257bb7c6615e816bbf6fadb_JaffaCakes118

Files

6f17cb8af257bb7c6615e816bbf6fadb_JaffaCakes118
.exe windows:6 windows x86 arch:x86

0a7b9174e85c867786f3f041a7b09b0e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\place\Method\must\originalback.pdb

Imports

kernel32

FlushFileBuffers
OutputDebugStringW
GetStringTypeW
GetConsoleCP
LoadLibraryExW
LeaveCriticalSection
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
CloseHandle
GetVolumeInformationA
GetWindowsDirectoryA
TlsAlloc
Sleep
EnterCriticalSection
InitializeCriticalSection
HeapReAlloc
VirtualProtect
LCMapStringW
CompareStringW
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
EncodePointer
DecodePointer
RaiseException
RtlUnwind
GetCommandLineA
IsProcessorFeaturePresent
GetLastError
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
HeapSize
IsDebuggerPresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThreadId
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
WriteFile
GetModuleFileNameW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
CreateFileW

user32

GetMessageA
TranslateMessage
UnregisterHotKey
RegisterWindowMessageA
LoadIconA
OffsetRect
CreateMenu
SetCapture
CloseClipboard
EndDialog
DeferWindowPos
BeginDeferWindowPos
ShowWindow

gdi32

GetPixel
CreateRectRgn
CreateFontA
CreateCompatibleDC
SelectClipRgn

comctl32

ImageList_Draw
ImageList_DragMove
ImageList_ReplaceIcon

comdlg32

GetOpenFileNameA
GetSaveFileNameA
FindTextA

shlwapi

PathRemoveBlanksA
PathStripPathA
UrlEscapeA
PathRemoveBackslashA

lz32

LZStart
LZDone
LZInit
LZSeek

mgmtapi

SnmpMgrCtl
SnmpMgrClose
SnmpMgrRequest
SnmpMgrOpen

Sections

.text
Size: 248KB - Virtual size: 247KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 163KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0a7b9174e85c867786f3f041a7b09b0e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comctl32

comdlg32

shlwapi

lz32

mgmtapi

Sections

.text Size: 248KB - Virtual size: 247KB

.rdata Size: 31KB - Virtual size: 30KB

.data Size: 5KB - Virtual size: 35KB

.rsrc Size: 163KB - Virtual size: 163KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 248KB - Virtual size: 247KB

.rdata
Size: 31KB - Virtual size: 30KB

.data
Size: 5KB - Virtual size: 35KB

.rsrc
Size: 163KB - Virtual size: 163KB

.reloc
Size: 6KB - Virtual size: 6KB