15d0b9c3524db4e5d91ffaa3e44d8275_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

15d0b9c3524db4e5d91ffaa3e44d8275_JaffaCakes118
Size

254KB
MD5

15d0b9c3524db4e5d91ffaa3e44d8275
SHA1

8f49b057186ab849904bcc6c9b8cd61255c4ea65
SHA256

50a938953e3af11f50dbc9e9090807ab7e0195451b9bf609f28f7075f0af9f56
SHA512

b99a792b99a188e0a1b02ac1429b2e545fc12e51dc705d613de781b422a7676baeb3ffb6e51b70e8df282cb2aa261a71dea91820c0fc429ed1a19fd45196e323
SSDEEP

6144:uTHv0UzaJQIbdiUAn8yFGXGqiWJhAEAB5vIdXrD031bFud:KzaJQIU8l6K0P4XQnud

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
15d0b9c3524db4e5d91ffaa3e44d8275_JaffaCakes118

Files

15d0b9c3524db4e5d91ffaa3e44d8275_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0edfbea4d5776e0f2833e06220c8c1f2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
LoadLibraryW
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
Sleep
GetLastError
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
FreeLibrary
lstrcmpW
GetProcAddress

advapi32

OpenProcessToken
GetTokenInformation

imagehlp

SymFromAddr
SymUnDName
SymGetLineFromName64
SymSetOptions
SymGetTypeFromName
SymSetContext
FindExecutableImageEx
ImageRvaToSection
SymRegisterCallback64
StackWalk
SearchTreeForFile
SymEnumSymbols
MapFileAndCheckSumA
SymGetLinePrev64
SymGetTypeInfo
ImageAddCertificate
SymMatchString
ImageGetCertificateHeader
RemovePrivateCvSymbolicEx
ImageNtHeader
FindFileInPath
SymFunctionTableAccess64

oleprn

DllUnregisterServer
DllCanUnloadNow
DllGetClassObject

Sections

.icode
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.C
Size: 1024B - Virtual size: 241KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.PDCIX
Size: 4KB - Virtual size: 510KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 73KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xaTdAP
Size: 3KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 141KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Me
Size: 4KB - Virtual size: 333KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0edfbea4d5776e0f2833e06220c8c1f2

Headers

File Characteristics

Imports

kernel32

advapi32

imagehlp

oleprn

Sections

.icode Size: 4KB - Virtual size: 4KB

.C Size: 1024B - Virtual size: 241KB

.text Size: 12KB - Virtual size: 11KB

.rdata Size: 1KB - Virtual size: 14KB

.PDCIX Size: 4KB - Virtual size: 510KB

.edata Size: 73KB - Virtual size: 108KB

.xaTdAP Size: 3KB - Virtual size: 124KB

.data Size: 6KB - Virtual size: 53KB

.edata Size: 141KB - Virtual size: 222KB

.Me Size: 4KB - Virtual size: 333KB

.rsrc Size: 2KB - Virtual size: 1KB

.icode
Size: 4KB - Virtual size: 4KB

.C
Size: 1024B - Virtual size: 241KB

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 1KB - Virtual size: 14KB

.PDCIX
Size: 4KB - Virtual size: 510KB

.edata
Size: 73KB - Virtual size: 108KB

.xaTdAP
Size: 3KB - Virtual size: 124KB

.data
Size: 6KB - Virtual size: 53KB

.edata
Size: 141KB - Virtual size: 222KB

.Me
Size: 4KB - Virtual size: 333KB

.rsrc
Size: 2KB - Virtual size: 1KB