a7d6adf011c4b0bb6b79a0805095c6d2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a7d6adf011c4b0bb6b79a0805095c6d2_JaffaCakes118
Size

5.6MB
MD5

a7d6adf011c4b0bb6b79a0805095c6d2
SHA1

8558a08a7f3d79afd9d3a8260d2c517ea7a0c304
SHA256

b1e49f1e67d4f7a1f6f485de52d97010dcca0ccb1d5838c30fb45e52eb25d945
SHA512

c7a58ffe4408a041da8083a5c2dcd1b1a933ded04144ac8eb86acbccaf0168dd883b8a8ec32641176e53c3ef9fc031070ea7240c4a5ff7f46fb812189b3e6411
SSDEEP

98304:VDLcBVNyNk6WHPEL+LBetwYa0IIrsLuxZXX2SaSsIxaHyVuljZzNOO5TU:B++W6WvEL+4tw7OrDZnFrfaHywBZ5Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a7d6adf011c4b0bb6b79a0805095c6d2_JaffaCakes118

Files

a7d6adf011c4b0bb6b79a0805095c6d2_JaffaCakes118
.exe windows:6 windows x86 arch:x86

e858930dd08545fbf772619bbde262c0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

PostQuitMessage
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

advapi32

CryptDestroyHash

shell32

ShellExecuteA

msvcp140

?getloc@ios_base@std@@QBE?AVlocale@2@XZ

wininet

InternetConnectA

imm32

ImmSetCompositionWindow

d3d9

Direct3DCreate9

vcruntime140

_purecall

api-ms-win-crt-stdio-l1-1-0

__p__commode

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-math-l1-1-0

_libm_sse2_cos_precise

api-ms-win-crt-convert-l1-1-0

strtod

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-runtime-l1-1-0

terminate

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-string-l1-1-0

strncpy

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64

wtsapi32

WTSSendMessageW

Sections

,"7h$1zo
Size: - Virtual size: 253KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

bcA#Xx:H
Size: - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

G:9*H[U&
Size: - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Cs%?/lIn
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

fD@v[%lD
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

[V]*/>;-
Size: 5.6MB - Virtual size: 5.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

@)Hx&w]0
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Q%Pu5CXu
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e858930dd08545fbf772619bbde262c0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

msvcp140

wininet

imm32

d3d9

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

wtsapi32

Sections

,"7h$1zo Size: - Virtual size: 253KB

bcA#Xx:H Size: - Virtual size: 142KB

G:9*H[U& Size: - Virtual size: 223KB

Cs%?/lIn Size: - Virtual size: 1KB

fD@v[%lD Size: - Virtual size: 3.2MB

[V]*/>;- Size: 5.6MB - Virtual size: 5.6MB

@)Hx&w]0 Size: 1KB - Virtual size: 1KB

Q%Pu5CXu Size: 512B - Virtual size: 469B

,"7h$1zo
Size: - Virtual size: 253KB

bcA#Xx:H
Size: - Virtual size: 142KB

G:9*H[U&
Size: - Virtual size: 223KB

Cs%?/lIn
Size: - Virtual size: 1KB

fD@v[%lD
Size: - Virtual size: 3.2MB

[V]*/>;-
Size: 5.6MB - Virtual size: 5.6MB

@)Hx&w]0
Size: 1KB - Virtual size: 1KB

Q%Pu5CXu
Size: 512B - Virtual size: 469B