167dbf202b5f70c19bd67048b5563abd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

167dbf202b5f70c19bd67048b5563abd_JaffaCakes118
Size

524KB
MD5

167dbf202b5f70c19bd67048b5563abd
SHA1

e861e655d72aa5b24a582d448c35c28876b31d1c
SHA256

ec098a4484c8ade9ceecedb9a695045d7b19d3a59760d12e5bd5e20bb6dc8581
SHA512

b615c9e5b486e00061a6c801e9d2603b270a9f83bca8eff8af1e0bba84ec99c6a1fe1e089aed3d4c96a74dafb5f3409f1307c4ff749d2392081fcdd2d174a433
SSDEEP

6144:u2Op+PQgQtlOwfLylUNjjm3tYkODw/NBm9n5sHGr:KjgQK4LylURjiYwrmbsmr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
167dbf202b5f70c19bd67048b5563abd_JaffaCakes118

Files

167dbf202b5f70c19bd67048b5563abd_JaffaCakes118
.dll windows:4 windows x86 arch:x86

3de474e0f1faafe725e5f8986ea44c96

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
GetProcAddress
LoadLibraryA
GetModuleFileNameA
DisableThreadLibraryCalls
VirtualProtect
CreateFileA
InterlockedExchange
RtlUnwind
IsBadWritePtr
IsBadReadPtr
HeapValidate
RaiseException
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
GetModuleHandleA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
FatalAppExitA
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetCurrentThread
TerminateProcess
GetCurrentProcess
HeapAlloc
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetFilePointer
FlushFileBuffers
CloseHandle
SetUnhandledExceptionFilter
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetConsoleCtrlHandler
IsBadCodePtr
UnhandledExceptionFilter
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
SetStdHandle
ReadFile
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetVersionExA
GetTimeZoneInformation
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile

user32

GetAsyncKeyState

Sections

.text
Size: 452KB - Virtual size: 450KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3de474e0f1faafe725e5f8986ea44c96

Headers

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 452KB - Virtual size: 450KB

.rdata Size: 32KB - Virtual size: 30KB

.data Size: 16KB - Virtual size: 21KB

.idata Size: 4KB - Virtual size: 2KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 452KB - Virtual size: 450KB

.rdata
Size: 32KB - Virtual size: 30KB

.data
Size: 16KB - Virtual size: 21KB

.idata
Size: 4KB - Virtual size: 2KB

.reloc
Size: 16KB - Virtual size: 15KB