7de33778a9c39f681286a56192667a65_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

7de33778a9c39f681286a56192667a65_JaffaCakes118
Size

111KB
MD5

7de33778a9c39f681286a56192667a65
SHA1

cc648cf456946f6a7b75497f422ed1e7dbbee24f
SHA256

2419a3a6094840a934cb33580568707ef498cd2c82861495cbd1fa6aac7be0e1
SHA512

71a88cd7efecef91c846d32dd4b27523d8926550d1ea01a7d86cb77632484a0dc0bc14f1d081dc6bb203f715fa9d5f76f002fb5b523222ebd60c852796670f20
SSDEEP

3072:FaxcPY+efsiUnMOLnB6MaAAmLXbUSMsl7K:FGcwncMgB6DAdd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7de33778a9c39f681286a56192667a65_JaffaCakes118

Files

7de33778a9c39f681286a56192667a65_JaffaCakes118
.exe windows:6 windows x86 arch:x86

0e97d7a808b9a3169228012ce366ca01

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

CharNextW

winspool.drv

OpenPrinterW

advapi32

CopySid

shell32

SHGetFileInfoW

ole32

CoInitialize

oleaut32

VarUI4FromStr

sqlite

sqlite3_exec

msvcp140

?_Xout_of_range@std@@YAXPBD@Z

shlwapi

AssocQueryStringW

vcruntime140

memset

api-ms-win-crt-runtime-l1-1-0

exit

api-ms-win-crt-stdio-l1-1-0

fclose

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-filesystem-l1-1-0

_wrename

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.MPRESS1
Size: 95KB - Virtual size: 288KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0e97d7a808b9a3169228012ce366ca01

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

winspool.drv

advapi32

shell32

ole32

oleaut32

sqlite

msvcp140

shlwapi

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.MPRESS1 Size: 95KB - Virtual size: 288KB

.MPRESS2 Size: 4KB - Virtual size: 4KB

.rsrc Size: 11KB - Virtual size: 11KB

.MPRESS1
Size: 95KB - Virtual size: 288KB

.MPRESS2
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 11KB - Virtual size: 11KB