9a4dc5eb07f54a4baba258ae14260ea7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

9a4dc5eb07f54a4baba258ae14260ea7_JaffaCakes118
Size

159KB
MD5

9a4dc5eb07f54a4baba258ae14260ea7
SHA1

e2ee04b3ec4c5182351d7164c2ee7c85a2ccb512
SHA256

dd2113736836d514a44c8641c0df14d6caa57f6cfa620d4f02c8d3d5c7e12494
SHA512

40885e62be3f7fb6581ac1cacd7a9614ae7ed0b1e2e1152df76ac7fdc0ae692215ce447e15b8672113b0e1bfb1fdbec1d2072f7e874beb9007be2826d2796cbd
SSDEEP

3072:KJDMIjDAo1bV5ImiDf/3Lrf7nDVF6PUp1Yom4CTl:K+IjD/kf/brfzDVlsHT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9a4dc5eb07f54a4baba258ae14260ea7_JaffaCakes118

Files

9a4dc5eb07f54a4baba258ae14260ea7_JaffaCakes118
.exe windows:10 windows x86 arch:x86

2bc9f5efba393d8c37c2c4631a9cde28

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

advapi32

RegCloseKey

gdi32

LPtoDP

user32

GetDC

msvcrt

exit

api-ms-win-core-com-l1-1-0

CoCreateGuid

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-0

RaiseException

api-ms-win-core-processthreads-l1-1-0

TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString

api-ms-win-core-synch-l1-1-0

SetEvent

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-winrt-l1-1-0

RoInitialize

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

comctl32

ord345

comdlg32

FindTextW

ntdll

WinSqmAddToStream

propsys

PropVariantToStringVectorAlloc

shell32

DragFinish

shlwapi

SHStrDupW

winspool.drv

ClosePrinter

urlmon

FindMimeFromData

Sections

.MPRESS1
Size: 50KB - Virtual size: 244KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2bc9f5efba393d8c37c2c4631a9cde28

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

gdi32

user32

msvcrt

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

comctl32

comdlg32

ntdll

propsys

shell32

shlwapi

winspool.drv

urlmon

Sections

.MPRESS1 Size: 50KB - Virtual size: 244KB

.MPRESS2 Size: 5KB - Virtual size: 4KB

.rsrc Size: 103KB - Virtual size: 103KB

.MPRESS1
Size: 50KB - Virtual size: 244KB

.MPRESS2
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 103KB - Virtual size: 103KB