0c97b8878631c16e2bec6b23ef2fa4f6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0c97b8878631c16e2bec6b23ef2fa4f6_JaffaCakes118
Size

155KB
MD5

0c97b8878631c16e2bec6b23ef2fa4f6
SHA1

5f0befef5f5266a04460acabc1193748b65f146d
SHA256

53c5999c2943a43286841ff39ef432dd1dd9cbddd7a69f6cf426ea689effaaf1
SHA512

a1389ffb24be222c01c476949cfc4075c90006d310098fd1d28ba9d947b8381ab89fe8adb84e5fd0ce2c90bfe854ed6c72eacd791bc1c15ceb0900de84710386
SSDEEP

3072:vbblsaz+NTVP6RT0fTnEJcHj5bt3Uk+ZFJtqb9CElt9VTRd:vGaz+XCR4TEJ2j/kfZFoMEz9hr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c97b8878631c16e2bec6b23ef2fa4f6_JaffaCakes118

Files

0c97b8878631c16e2bec6b23ef2fa4f6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2a21eb1dda6170cd69669198f3004c82

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Rulu\Ydobena.pdb

Imports

gdi32

SetAbortProc
AbortDoc
SetRectRgn
CombineRgn
EndDoc
GetDeviceCaps
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
StretchDIBits

crypt32

CryptHashCertificate
CertFreeCertificateChain
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertCreateCertificateContext
CryptDecodeObject
CertFreeCertificateContext
CertFindCertificateInStore
CertDeleteCertificateFromStore
CertEnumCertificatesInStore
CertStrToNameW

secur32

FreeCredentialsHandle
InitializeSecurityContextW
DeleteSecurityContext
FreeContextBuffer
AcquireCredentialsHandleW

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
HeapSize
GetProcessHeap
GetLocalTime
CreateFileW
FindClose
FindNextFileW
FindFirstFileW
TlsSetValue
TlsAlloc
SetTapePosition
HeapAlloc
Sleep
LockFile
UnlockFile
GetLastError
CloseHandle
GetFileType
GetModuleHandleA
GetStartupInfoW
GetVersionExA
HeapFree
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
ExitProcess
GetProcAddress
TerminateProcess
GetCurrentProcess
SetFilePointer
WriteFile
SetStdHandle
SetHandleCount
GetStdHandle
GetStartupInfoA
SetEndOfFile
ReadFile
GetModuleFileNameA
UnhandledExceptionFilter
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
FlushFileBuffers
CreateFileA
LoadLibraryA
RtlUnwind
InterlockedExchange
VirtualQuery

Sections

.text
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 658KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2a21eb1dda6170cd69669198f3004c82

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdi32

crypt32

secur32

kernel32

Sections

.text Size: 64KB - Virtual size: 62KB

.rdata Size: 60KB - Virtual size: 59KB

.data Size: 24KB - Virtual size: 658KB

.reloc Size: 12KB - Virtual size: 10KB

.text
Size: 64KB - Virtual size: 62KB

.rdata
Size: 60KB - Virtual size: 59KB

.data
Size: 24KB - Virtual size: 658KB

.reloc
Size: 12KB - Virtual size: 10KB