81e41795c97af6db8b66229a3b8dd2c4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

81e41795c97af6db8b66229a3b8dd2c4_JaffaCakes118
Size

53KB
MD5

81e41795c97af6db8b66229a3b8dd2c4
SHA1

789577a8a3e06b16f298058d0b517318e0bd60c9
SHA256

5a27cc4b672041a2cde96c01f2201663a0d540a264df93e2773cf071cab41eb9
SHA512

fb896d258d456547b1db31a1d615d63c312b43b0da45b1f7b01a0c05c136a866608597d3834c4f991c91b5c4f9bd764fb73d79f29062b0ed7863ab9e2a76171b
SSDEEP

384:KBMukXt/YFjxIag8z6kONvBX/MWC5paGUWvPP2L/2WUisyFW1mnWAOufano5wACK:KH5z2BX/5idUgPq2WbsyRuuYotCtGB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
81e41795c97af6db8b66229a3b8dd2c4_JaffaCakes118

Files

81e41795c97af6db8b66229a3b8dd2c4_JaffaCakes118
.exe windows:6 windows x64 arch:x64

7b00a8c18f02cd6e87a113c72863db63

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

SizeofResource
ActivateActCtx
VirtualProtect
VirtualAlloc
FindResourceA
CreateActCtxA
DeactivateActCtx
Sleep
GetTempPathA
LoadLibraryA
LockResource
LoadResource
GetProcAddress
GetSystemTime
GetTempFileNameA
ReleaseActCtx
GetCurrentProcessId
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead

vcruntime140

memset
__C_specific_handler
memcpy

api-ms-win-crt-runtime-l1-1-0

__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_exit
_initterm_e
_errno
__p___argc
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_get_initial_narrow_environment
_initialize_narrow_environment
exit
_configure_narrow_argv
_set_app_type
_seh_filter_exe
_initterm

api-ms-win-crt-stdio-l1-1-0

_set_fmode
ftell
fread
getchar
__p__commode
__stdio_common_vfprintf
fseek
fclose
_wfopen_s
fopen

api-ms-win-crt-heap-l1-1-0

free
malloc
_set_new_mode

api-ms-win-crt-utility-l1-1-0

rand
srand

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7b00a8c18f02cd6e87a113c72863db63

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 12KB - Virtual size: 11KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 732B

.gfids Size: 512B - Virtual size: 28B

.rsrc Size: 32KB - Virtual size: 31KB

.reloc Size: 512B - Virtual size: 28B

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 732B

.gfids
Size: 512B - Virtual size: 28B

.rsrc
Size: 32KB - Virtual size: 31KB

.reloc
Size: 512B - Virtual size: 28B