21929c467ce65e655dd1e1311c4089f3_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

21929c467ce65e655dd1e1311c4089f3_JaffaCakes118
Size

156KB
MD5

21929c467ce65e655dd1e1311c4089f3
SHA1

aacfc2694ab925a8fedef816256430f793003207
SHA256

d7dc82cf8b2974b6b7f7281146cedf194da7a7e62b334451e462cfe523782382
SHA512

615cd802d0d7435a63e68543af12554939f452eab5a4e80b8a25e689ec3714fb21835eb506fb2ab81d912e7f4cd266a29d14aa7ebe35947ffff946eae7db8d48
SSDEEP

3072:KszVcfQEoDtbOJc5AEPKhmm2jsm/95yOxeWVD:Ksg7Ob5AEPI52gm/95yXWVD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
21929c467ce65e655dd1e1311c4089f3_JaffaCakes118

Files

21929c467ce65e655dd1e1311c4089f3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b2f256e72b00c8b02f2efb942d1a7dad

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\inetpub\Temp\867bj3ku5sg27ovgn2h9ujcti3\Stub.pdb

Imports

user32

DialogBoxParamA

psapi

GetModuleFileNameExA

kernel32

GetCurrentThreadId
FreeResource
HeapAlloc
HeapFree
GetProcessHeap
GetTickCount
GetCurrentThread
GetLastError
GetThreadContext
CloseHandle
CreateFileA
VirtualFree
GetProcAddress
VirtualAlloc
LoadLibraryA
GetModuleHandleA
CreateThread
SetThreadContext
GetCurrentProcess
GetCommandLineA
CreateProcessA
GetStartupInfoA
VirtualAllocEx
WriteProcessMemory
ResumeThread
GetVersionExA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapDestroy
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
RtlUnwind
HeapSize
HeapReAlloc
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSection
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle

Sections

.text
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b2f256e72b00c8b02f2efb942d1a7dad

Headers

File Characteristics

PDB Paths

Imports

user32

psapi

kernel32

Sections

.text Size: 48KB - Virtual size: 44KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 80KB - Virtual size: 76KB

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 48KB - Virtual size: 44KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 80KB - Virtual size: 76KB

.reloc
Size: 8KB - Virtual size: 5KB