0c4edc516a1d39b9c66b560744276ca1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0c4edc516a1d39b9c66b560744276ca1_JaffaCakes118
Size

93KB
MD5

0c4edc516a1d39b9c66b560744276ca1
SHA1

f83602080424e0a7d0a79c2eab5927cc9eba07b7
SHA256

100439755f4c18251ee9e16b36f69eacf01ef062c0edcfd6599d71fd60390e64
SHA512

8e205e35ef408b876254e850c1a183db42ed52616d7a484f9f59360f9c02e7a856ae1deeb001a1a56ebc7d2edc0a3f178043da2edde5a9ca47bf0679b0c4b77c
SSDEEP

1536:LBB1IbFtyM1iwOiyIrVa4xlFdZSf5ky/2p851SnpNiB4IHfLU1JZLxMGvZ9poBSO:tIBt0wOiy+a4HFjA5A6apoL/EJlvIlPB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c4edc516a1d39b9c66b560744276ca1_JaffaCakes118

Files

0c4edc516a1d39b9c66b560744276ca1_JaffaCakes118
.exe windows:6 windows x86 arch:x86

bf6c0901d6d5939708b45df16e88c081

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

wlcomm.pdb

Imports

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
TraceMessage

kernel32

TerminateProcess
GetCurrentProcess
CloseHandle
WaitForMultipleObjectsEx
CreateProcessW
GetCurrentProcessId
GetCurrentThread
DuplicateHandle
CreateEventW
ReleaseSemaphore
IsDebuggerPresent
WaitForSingleObject
GetCurrentThreadId
AddVectoredExceptionHandler
SetHandleInformation
GetLastError
CreateSemaphoreW
FreeLibrary
GetProcAddress
LoadLibraryW
SetErrorMode
SetProcessShutdownParameters
SetConsoleCtrlHandler
GetModuleHandleExW
HeapSetInformation
GetTempPathW
InterlockedCompareExchange
MoveFileW
CreateFileW
DeleteFileW
OpenProcess
CreateFileMappingW
MapViewOfFile
VirtualLock
VirtualUnlock
UnmapViewOfFile
lstrlenW
GetProcessHeap
HeapFree
CreateToolhelp32Snapshot
Thread32First
GetProcessId
OpenThread
SuspendThread
Thread32Next
InterlockedDecrement
WriteFile
InterlockedIncrement
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
InterlockedExchange
GetTempFileNameW
HeapAlloc

msvcr80

_wtoi64
??3@YAXPAX@Z
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_callnewh
malloc
_set_abort_behavior
wcsstr
memset
_vsnwprintf_s
?terminate@@YAXXZ
memcpy

ole32

CoInitializeSecurity
CoUninitialize
CoInitializeEx

shlwapi

StrStrIW
PathFindExtensionW
PathFindFileNameW

oleaut32

SetOaNoCache

faultrep

ReportFault

psapi

GetModuleFileNameExW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 916B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 69KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bf6c0901d6d5939708b45df16e88c081

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcr80

ole32

shlwapi

oleaut32

faultrep

psapi

version

Sections

.text Size: 15KB - Virtual size: 15KB

.data Size: 512B - Virtual size: 916B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 69KB - Virtual size: 72KB

.text
Size: 15KB - Virtual size: 15KB

.data
Size: 512B - Virtual size: 916B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 69KB - Virtual size: 72KB