a47f58d665832499a338f4d795b253df_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a47f58d665832499a338f4d795b253df_JaffaCakes118
Size

27KB
MD5

a47f58d665832499a338f4d795b253df
SHA1

ce21b7810cd517cc256f2a348a8a3e6f71a1ff96
SHA256

865457b8e14516508dbfcb031528575cbf219a5b35c01f5a2a26c64007cb87c3
SHA512

36434513092dd878c200647a09c4b3816606efb38f37fda7d90e0165bc5640aed0f1ce5685a78810d0c91a18c7d3c2a84a346da3743fb466787db5d703453561
SSDEEP

384:Bz8v+1mNP88QN0CmVD6SxY9NYzJYFoI8QZmFEWfvAtEDxdbCW/8g7OgDlE7vvxlz:BzCDzD6/yJYFoI87BItEDDJ7O+E7D2g

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a47f58d665832499a338f4d795b253df_JaffaCakes118

Files

a47f58d665832499a338f4d795b253df_JaffaCakes118
.exe windows:10 windows x86 arch:x86

78c27844a2d6b78010d7a7141b0b574d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

advapi32

RegCloseKey

gdi32

BitBlt

user32

GetDC

msvcrt

free

comctl32

ord329

shell32

ord723

shlwapi

ord460

api-ms-win-core-com-l1-1-0

CoTaskMemFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetProcessId

api-ms-win-core-errorhandling-l1-1-0

SetLastError

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount

api-ms-win-core-synch-l1-1-0

SetEvent

api-ms-win-core-heap-l1-1-0

HeapFree

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-io-l1-1-0

CreateIoCompletionPort

api-ms-win-core-path-l1-1-0

PathCchAppend

api-ms-win-eventing-provider-l1-1-0

EventWrite

api-ms-win-core-winrt-l1-1-0

RoActivateInstance

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString

api-ms-win-core-string-l2-1-0

CharLowerW

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-eventing-controller-l1-1-0

StopTraceW

api-ms-win-core-file-l1-1-0

DeleteFileW

ntdll

RtlNtStatusToDosError

ole32

CoInitialize

Sections

.MPRESS1
Size: 18KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

78c27844a2d6b78010d7a7141b0b574d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

gdi32

user32

msvcrt

comctl32

shell32

shlwapi

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-eventing-controller-l1-1-0

api-ms-win-core-file-l1-1-0

ntdll

ole32

Sections

.MPRESS1 Size: 18KB - Virtual size: 52KB

.MPRESS2 Size: 5KB - Virtual size: 5KB

.rsrc Size: 3KB - Virtual size: 3KB

.MPRESS1
Size: 18KB - Virtual size: 52KB

.MPRESS2
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 3KB - Virtual size: 3KB