0d91e09408327089eab2b910d731eae1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0d91e09408327089eab2b910d731eae1_JaffaCakes118
Size

550KB
MD5

0d91e09408327089eab2b910d731eae1
SHA1

e3f0ac6f42a4a10e38560553a1425c1badf4bbc1
SHA256

6893ad5c47536cca6d2bfa9e4f26bb2959dd8277482b882c1f49b5971679e6fc
SHA512

088ba313b181429d2b7163a1a75e89c45dcc09b83c7609e78c678483cecbdc23dfcf7788fca7b7fe57d532054eeffcaca280b8f5ba521e0614b32d848ac5b0b5
SSDEEP

12288:0Kg4rmRJEYLxDpkv3FRz7IVuiNPb6IyREQ0+Lg6nr9AM:05PoY1DpYFRz7MtyRcmrmM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d91e09408327089eab2b910d731eae1_JaffaCakes118

Files

0d91e09408327089eab2b910d731eae1_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6080401d79b1d09280a167cb50e039ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CallNamedPipeA
ReadConsoleA
InterlockedDecrement
SetEnvironmentVariableW
GetProfileSectionA
OpenSemaphoreA
SetTapeParameters
GetProcessPriorityBoost
SetCommState
SetProcessPriorityBoost
GetPriorityClass
LoadLibraryW
GetConsoleMode
TerminateThread
CopyFileW
GetPrivateProfileStructW
ReadFile
lstrcatA
GetBinaryTypeW
GetACP
SetEndOfFile
FindNextVolumeMountPointW
DisconnectNamedPipe
RaiseException
GetStdHandle
FreeLibraryAndExitThread
GetCurrentDirectoryW
SetLastError
GetProcAddress
SetVolumeLabelW
EnterCriticalSection
LocalAlloc
SetCurrentDirectoryW
SetFileApisToANSI
AddAtomA
GetTapeParameters
WaitForMultipleObjects
LocalFree
lstrcpyW
CreateMutexW
lstrlenW
EnumResourceNamesW
GetLastError
MoveFileA
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
LeaveCriticalSection
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapFree
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
HeapSize
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetOEMCP
IsValidCodePage
MultiByteToWideChar
LoadLibraryA
SetFilePointer
WideCharToMultiByte
GetConsoleCP
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CloseHandle
CreateFileA
GetModuleHandleA

advapi32

AccessCheck
RevertToSelf

winhttp

WinHttpCloseHandle

Exports

Exports

_asdga@4
_weewgg@8
_wsefwrgwrg@4
_ydtiuiei7@8

Sections

.text
Size: 512KB - Virtual size: 511KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6080401d79b1d09280a167cb50e039ae

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

winhttp

Exports

Exports

Sections

.text Size: 512KB - Virtual size: 511KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 7KB - Virtual size: 4.0MB

.rsrc Size: 16KB - Virtual size: 16KB

.text
Size: 512KB - Virtual size: 511KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 7KB - Virtual size: 4.0MB

.rsrc
Size: 16KB - Virtual size: 16KB