06b27139eb1dfc9e1db52fe95c2a791d_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

06b27139eb1dfc9e1db52fe95c2a791d_JaffaCakes118
Size

81KB
MD5

06b27139eb1dfc9e1db52fe95c2a791d
SHA1

56f35f7c51acbed3287bf831d68aad5232777fba
SHA256

cdceec8fee5352588fa9ff52e7c4f32f23ec31d37ba7a0453d4a4e4a2441ac42
SHA512

b2d03c06a8a2641b722a468840e3df924aef49585579ea29e39ff17ddf801020d63c59405aee5e03556caa2134ad37c0968b4b5f8a83f97f5775be76de6df785
SSDEEP

768:iCktbsaVOb+f1HHwl5V6vckxNtZoYIBAspM3C72pD0HQMEKVZvhfQDZV+lwn2oEv:SslSZvckIXBppo9mpEKfZzAXADPO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06b27139eb1dfc9e1db52fe95c2a791d_JaffaCakes118

Files

06b27139eb1dfc9e1db52fe95c2a791d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

45a58e24b81d4be23b9c97522ff9c8b5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CopyFileA
LoadLibraryA
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetSystemTime
CreateThread
HeapReAlloc
GetProcAddress
GetStringTypeW
LCMapStringW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetLastError
MultiByteToWideChar
ReadFile
Sleep
WriteFile
SystemTimeToFileTime
MoveFileExA
GetFileSize
CreateFileA
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
HeapSize
GetModuleFileNameW
GetStdHandle
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
RtlUnwind
TlsGetValue
HeapFree
HeapAlloc
EncodePointer
DecodePointer
GetModuleHandleW
ExitProcess
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc

user32

PostMessageA
DispatchMessageA
FindWindowA
SetWindowLongA
TranslateMessage
GetClientRect
wsprintfA
RegisterClassExA
CreateWindowExA
DefWindowProcA
PeekMessageA
GetMessageA

advapi32

CryptDestroyHash
CryptVerifySignatureA
CryptDestroyKey
CryptCreateHash
CryptImportKey
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptHashData

ole32

CoCreateInstance
CoInitialize

oleaut32

VariantInit
SysAllocStringLen
SysFreeString
SysAllocString

shlwapi

SHSetValueA
SHGetValueA

urlmon

CoInternetSetFeatureEnabled
ObtainUserAgentString

wininet

InternetCloseHandle
InternetOpenA
InternetSetOptionA
InternetReadFile
HttpQueryInfoA
InternetOpenUrlA

rpcrt4

UuidCreateSequential

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

45a58e24b81d4be23b9c97522ff9c8b5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

urlmon

wininet

rpcrt4

Sections

.text Size: 52KB - Virtual size: 52KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 3KB - Virtual size: 7KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 52KB - Virtual size: 52KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 3KB - Virtual size: 7KB

.reloc
Size: 6KB - Virtual size: 5KB