82c49dd2427383d22d1e836e2adfd266_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

82c49dd2427383d22d1e836e2adfd266_JaffaCakes118
Size

482KB
MD5

82c49dd2427383d22d1e836e2adfd266
SHA1

9800e2b9e792e3f75aa34b65ba9a1f47b4371862
SHA256

f2551d6506bebf6a9522f1fef7764f483214f8baee5595957dc80472f0b43b05
SHA512

667832b086a226e09fce07d8c24cdff287a88821a7b026490ba27db5db1f90f3aa3af7d97ad76fb6ddd707fa294373c75366ae55ecaa3a8325f72af3fca4912a
SSDEEP

12288:+G3HX9eWOStDm1/NvNsSpSe4rPPN/7BO2XG:3Neb6DsvJQH9T/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
82c49dd2427383d22d1e836e2adfd266_JaffaCakes118

Files

82c49dd2427383d22d1e836e2adfd266_JaffaCakes118
.exe windows:5 windows x86 arch:x86

64c27d2587abbd0e23e801e6d1f3eaea

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

PulseEvent
HeapReAlloc
SetDefaultCommConfigA
HeapCompact
CommConfigDialogA
lstrcpynA
HeapAlloc
WriteTapemark
InterlockedIncrement
GetCurrentProcess
ZombifyActCtx
SetHandleInformation
WaitForSingleObject
GetModuleHandleW
GetProcessHeap
ReadConsoleW
WaitNamedPipeW
WriteFile
FindActCtxSectionStringA
ActivateActCtx
FreeConsole
SetConsoleCP
GetFileAttributesA
VerifyVersionInfoA
HeapQueryInformation
SetSystemPowerState
GetModuleFileNameW
LCMapStringA
ReleaseActCtx
SetLastError
AttachConsole
GetProcessHeaps
VerLanguageNameW
GetAtomNameA
LocalAlloc
SetConsoleDisplayMode
OpenEventA
HeapLock
GetTapeParameters
WaitForMultipleObjects
SetConsoleTitleW
CreateMutexA
GetPrivateProfileSectionA
GetConsoleTitleW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
GetVersion
GetCurrentProcessId
FindActCtxSectionStringW
WriteProcessMemory
DeleteFileA
Sleep
GetProcAddress
ExitProcess
GetStartupInfoW
RaiseException
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
HeapFree
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
InterlockedDecrement
GetStdHandle
GetModuleFileNameA
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringW

winhttp

WinHttpQueryOption
WinHttpSetOption

Sections

.text
Size: 369KB - Virtual size: 368KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 5.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mawa
Size: 512B - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

64c27d2587abbd0e23e801e6d1f3eaea

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

winhttp

Sections

.text Size: 369KB - Virtual size: 368KB

.data Size: 31KB - Virtual size: 5.3MB

.mawa Size: 512B - Virtual size: 1B

.rsrc Size: 80KB - Virtual size: 79KB

.text
Size: 369KB - Virtual size: 368KB

.data
Size: 31KB - Virtual size: 5.3MB

.mawa
Size: 512B - Virtual size: 1B

.rsrc
Size: 80KB - Virtual size: 79KB