23eabe6dd3429b7208fe4bf35e65ab48_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

23eabe6dd3429b7208fe4bf35e65ab48_JaffaCakes118
Size

185KB
MD5

23eabe6dd3429b7208fe4bf35e65ab48
SHA1

38f282daa3e1231cf7cf83159135b7bd1af82781
SHA256

92523b968636469d9b8b4feaf8936939df6e322217a1d791a7e1f93a1d47c795
SHA512

ff5b30e095fc76a5840fa851c990ee1c5e2e4f1788b8b7810b9dd1ff65b8a990188d38216539321413c1478defa245f601e9099f41cabd211ce7587ce1938340
SSDEEP

3072:dNiRLWjzCKyGxZ1ldEcLIhAr5nV5Ot2Y9LXiHsi9VKJerEJv0fdU68qOc42Rb2Qg:LiFWjuqTNLIhAr5LOQOLyMi9VKJerEJd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
23eabe6dd3429b7208fe4bf35e65ab48_JaffaCakes118

Files

23eabe6dd3429b7208fe4bf35e65ab48_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f6b5c3c91b16dd393af0117d6f2959c5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

davcdata.pdb

Imports

kernel32

SetEvent
OpenProcess
CloseHandle
DuplicateHandle
GetCurrentProcess
InterlockedIncrement
GetCurrentProcessId
ExitProcess
DeleteTimerQueueTimer
InterlockedExchange
WaitForMultipleObjects
CreateThread
CreateEventA
CreateTimerQueueTimer
DisconnectNamedPipe
ReadFile
ConnectNamedPipe
CreateNamedPipeA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCommandLineA
GetVersionExA
RtlUnwind
RaiseException
GetModuleHandleA
WriteFile
GetStdHandle
GetModuleFileNameA
InterlockedDecrement
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
HeapAlloc
HeapReAlloc
HeapSize
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
IsBadWritePtr
VirtualQuery
IsBadReadPtr
IsBadCodePtr
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualProtect
GetSystemInfo
InterlockedCompareExchange
Sleep
LoadLibraryExW
GetProcAddress
FreeEnvironmentStringsA
GetLastError
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
SetLastError
lstrcatW
lstrcpyW
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
ResetEvent
EnterCriticalSection
LeaveCriticalSection
InterlockedExchangeAdd
CreateMutexW
ReleaseMutex

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor

user32

wsprintfW

rpcrt4

UuidCreate

Sections

.text
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PACK
Size: 144KB - Virtual size: 380KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f6b5c3c91b16dd393af0117d6f2959c5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

user32

rpcrt4

Sections

.text Size: 38KB - Virtual size: 38KB

.data Size: 1024B - Virtual size: 9KB

.rsrc Size: 1024B - Virtual size: 992B

PACK Size: 144KB - Virtual size: 380KB

.text
Size: 38KB - Virtual size: 38KB

.data
Size: 1024B - Virtual size: 9KB

.rsrc
Size: 1024B - Virtual size: 992B

PACK
Size: 144KB - Virtual size: 380KB