179185b8392879add2e4ccaaac5c00a2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

179185b8392879add2e4ccaaac5c00a2_JaffaCakes118
Size

68KB
MD5

179185b8392879add2e4ccaaac5c00a2
SHA1

ee76201ff4008219e0dde73ec8d7c1cc4d91da83
SHA256

507301a10559b53af73b4b0f2ef480fc5d07dec259239ad29fa91fa863908d8a
SHA512

a67ac31cc10f406d7840ea3bcf1feba8dfbf03f4ab7b5889d1c242bc9bfe3dc0c912143300dcf780216feea92595729f8c3a6ef6bc9fee750502fa31d69eb5ac
SSDEEP

1536:0J7/h9MNf0NJCcqS9Z35YcE/VO0izs+08V1LsRnXGT:0B/hOCuS9ZJXoOpz108V1LPT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
179185b8392879add2e4ccaaac5c00a2_JaffaCakes118

Files

179185b8392879add2e4ccaaac5c00a2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ba926f37e3e3a4c1452dbc9b0786969e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateMutexW
WaitForSingleObject
GetVersionExW
lstrlenW
lstrcpyW
lstrcpynW
GetLastError
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
GetCurrentProcess
Sleep
GetProcessHeap
GetProcAddress
GetModuleHandleA

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

query

CIState
CICreateCommand
DllCanUnloadNow
CIRestrictionToFullTree
CIBuildQueryNode
CollectFILTERPerformanceData

msls31

LsSetDoc
LsGetRubyLsimethods
LsGetMinDurBreaks
LsPointXYFromPointUV
LsdnResolvePrevTab
LsEnumLine
LsSetExpansion
LsForceBreakSubline
LsGetWarichuLsimethods
LsQueryPointPcpSubline
LsFindNextBreakSubline
LsQueryCpPpointSubline
LsResetRMInCurrentSubline
LsQueryTextCellDetails
LsdnFinishDelete
LsdnSetRigidDup

Sections

CODE
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.HbEnJ
Size: 2KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 11KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 10KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ba926f37e3e3a4c1452dbc9b0786969e

Headers

File Characteristics

Imports

kernel32

advapi32

query

msls31

Sections

CODE Size: 2KB - Virtual size: 1KB

.HbEnJ Size: 2KB - Virtual size: 74KB

.text Size: 18KB - Virtual size: 20KB

.rdata Size: 1KB - Virtual size: 46KB

.edata Size: 11KB - Virtual size: 64KB

.data Size: 5KB - Virtual size: 144KB

.edata Size: 10KB - Virtual size: 31KB

.rsrc Size: 18KB - Virtual size: 17KB

CODE
Size: 2KB - Virtual size: 1KB

.HbEnJ
Size: 2KB - Virtual size: 74KB

.text
Size: 18KB - Virtual size: 20KB

.rdata
Size: 1KB - Virtual size: 46KB

.edata
Size: 11KB - Virtual size: 64KB

.data
Size: 5KB - Virtual size: 144KB

.edata
Size: 10KB - Virtual size: 31KB

.rsrc
Size: 18KB - Virtual size: 17KB