a86fc983dba4510bfc365708f0453d73_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a86fc983dba4510bfc365708f0453d73_JaffaCakes118
Size

26KB
MD5

a86fc983dba4510bfc365708f0453d73
SHA1

c41cfd8568d7fb0c2238eca3250427a89e1f72c4
SHA256

d616235ebdd8e2bd62caf15b29f8253d96657054a3ebd3ccdb2915f07dd4299c
SHA512

9ad22321cdcd0ff4551783ef5f75be3fa8f3f269823c3846bf977d9bcad2543980dbc9924f6daf54231583ff83df97cc91123afd2a7941c6f812e4efff520850
SSDEEP

384:7F7d5A6wklOvMdv7mnQR/OE589OYlJrGFboZ1mOVCmey/n7vvxlL5ZWTe9WP:74LMh7iLvIYlJixPYCa/n7D5jg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a86fc983dba4510bfc365708f0453d73_JaffaCakes118

Files

a86fc983dba4510bfc365708f0453d73_JaffaCakes118
.exe windows:10 windows x86 arch:x86

485910aeb30a1178d30db1fdf0e1ba21

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

msvcrt

exit

rpcrt4

UuidEqual

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle

api-ms-win-core-file-l1-1-0

WriteFile

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-console-l1-1-0

WriteConsoleW

api-ms-win-core-errorhandling-l1-1-0

SetLastError

api-ms-win-security-base-l1-1-0

GetSecurityDescriptorControl

api-ms-win-core-heap-l1-1-0

HeapSetInformation

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

TerminateProcess

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount

ntdll

RtlAdjustPrivilege

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.MPRESS1
Size: 18KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

485910aeb30a1178d30db1fdf0e1ba21

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

rpcrt4

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.MPRESS1 Size: 18KB - Virtual size: 72KB

.MPRESS2 Size: 4KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 2KB

.MPRESS1
Size: 18KB - Virtual size: 72KB

.MPRESS2
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 2KB