6f9af610cda33548490eecfd3653d438_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

6f9af610cda33548490eecfd3653d438_JaffaCakes118
Size

22KB
MD5

6f9af610cda33548490eecfd3653d438
SHA1

bafb48a77bdb73fdb5691b51f0e400da1da550bb
SHA256

93c058fda33bbbeae0acc7c0af69d93e25e1db7953dd696d91eb6f9987f67729
SHA512

a13341c9cede2bc61c9a92642622111775ae188400b908b2e6149a617dc5d0cba5a32884554553574d94d7110c25da35489e03738bd90a5e9eac0f28568505ad
SSDEEP

384:dlXKxn9ZCL1QgGF7isflZFTgjPPbWc1Sawg0zw7vvxlLB9WY/CW:dlGnC67rf3RgjXbJ1S5gkw7DBj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6f9af610cda33548490eecfd3653d438_JaffaCakes118

Files

6f9af610cda33548490eecfd3653d438_JaffaCakes118
.exe windows:10 windows x86 arch:x86

8e8db301f3bed7fe10365b6d107d035d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

api-ms-win-crt-runtime-l1-1-0

_c_exit

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-crt-private-l1-1-0

wcschr

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress

api-ms-win-core-synch-l1-1-0

ReleaseMutex

api-ms-win-core-heap-l1-1-0

HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetLastError

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-core-com-l1-1-0

CoUninitialize

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-downlevel-shlwapi-l1-1-0

StrStrW

iertutil

ord797

edgeiso

ord130

api-ms-win-core-memory-l1-1-3

SetProcessValidCallTargets

userenv

GetAppContainerRegistryLocation

api-ms-win-core-registry-l1-1-0

RegCloseKey

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

msvcp_win

?_Xlength_error@std@@YAXPBD@Z

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

api-ms-win-core-processthreads-l1-1-2

SetProtectedPolicy

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

ntdll

NtQuerySystemInformation

wintrust

WTGetSignatureInfo

Sections

.MPRESS1
Size: 14KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8e8db301f3bed7fe10365b6d107d035d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-downlevel-shlwapi-l1-1-0

iertutil

edgeiso

api-ms-win-core-memory-l1-1-3

userenv

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

msvcp_win

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-errorhandling-l1-1-2

ntdll

wintrust

Sections

.MPRESS1 Size: 14KB - Virtual size: 56KB

.MPRESS2 Size: 5KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.MPRESS1
Size: 14KB - Virtual size: 56KB

.MPRESS2
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB