263d08d5b653ef06fc7b924500f40f7e_JaffaCakes118

General

Target

263d08d5b653ef06fc7b924500f40f7e_JaffaCakes118
Size

44KB
MD5

263d08d5b653ef06fc7b924500f40f7e
SHA1

1f47d62245b0740023c98e64e0c038c3754f0dbc
SHA256

d97c4039bcd81700ede107ba502b8432beb1e207693d88283a86681ed556945e
SHA512

797586dc0bd034cbd65d1678bb599f69d1838c5a665692dab522b37c80559045c54618946ec724c8a47e37db8d9bcac52d03e3cb3835f56a27e00348763c32cb
SSDEEP

768:tlfwSt5cASQKL4nSnFhGn1YR/Ocfe1ElSoPGE0P+s621lanWWUH3iZg+VfMpxGT/:rqARwTThwdFnizEy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
263d08d5b653ef06fc7b924500f40f7e_JaffaCakes118

Files

263d08d5b653ef06fc7b924500f40f7e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3523717f105f729857cee159c499d05b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
WriteFile
CreateFileA
GetLocaleInfoA
GetVersionExA
LoadLibraryA
GetProcAddress
GetModuleHandleA
TerminateThread
lstrcmpA
ReleaseMutex
CreateMutexA
CreateProcessA
GetModuleFileNameA
OutputDebugStringA
CopyFileA
SetFileAttributesA
GetFileAttributesA
GetWindowsDirectoryA
OpenProcess
GetSystemTime
ReadFile
SetFilePointer
lstrlenA
GetFileSize
WaitForSingleObject
GetTickCount
ExitThread
QueryPerformanceFrequency
QueryPerformanceCounter
lstrcmpiA
Sleep
ExitProcess
CreateThread
GetLastError
ExpandEnvironmentStringsA
GetTempPathA
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCurrentThreadId
GetStartupInfoA

advapi32

ImpersonateLoggedOnUser
OpenSCManagerA
EnumServicesStatusA
CloseServiceHandle
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetUserNameA
OpenProcessToken

msvcr71

free
malloc
strncpy
_vsnprintf
??3@YAXPAX@Z
_strlwr
??_V@YAXPAX@Z
strchr
strstr
strtok
_snprintf
_callnewh
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
_CxxThrowException
__security_error_handler
_except_handler3
__dllonexit
_onexit
_c_exit
_exit
_XcptFilter
_ismbblead
_cexit
exit
_acmdln
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
_controlfp
?terminate@@YAXXZ
sprintf
atoi
srand
rand

psapi

EnumProcessModules
GetModuleBaseNameA
EnumProcesses

Sections

.text
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 272KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3523717f105f729857cee159c499d05b

Headers

File Characteristics

Imports

kernel32

advapi32

msvcr71

psapi

Sections

.text Size: 28KB - Virtual size: 24KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 272KB

.text
Size: 28KB - Virtual size: 24KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 272KB