27b3e6a1467f3662018d4d11eb612d90_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

27b3e6a1467f3662018d4d11eb612d90_JaffaCakes118
Size

192KB
MD5

27b3e6a1467f3662018d4d11eb612d90
SHA1

08ec7eed28bcccbd3d3bde7edc718031ad568487
SHA256

803c4d072ad31cbd6afc2f9ceeb5b1ce6319c4a32a14199d71ec2de7aed08a48
SHA512

a3c12bae92026ab8f882f54f635bd8856fcbc6ca9bd95c88e5b742bd8537c43c989a69ee2d99a50eb25cddb2f3371373e8932d08302495cacae26f9b558af404
SSDEEP

6144:VBV/1zW+JpdCC/4fDczb5YDcgN5a8q/m5zt2CP:TzzW+JzC26Qzb5ecgXav8zQO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27b3e6a1467f3662018d4d11eb612d90_JaffaCakes118

Files

27b3e6a1467f3662018d4d11eb612d90_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fee819c94f618f33305707b039f05208

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
WideCharToMultiByte
GetCurrentProcessId
GetFileTime
GetModuleFileNameW
Sleep
GetTickCount
FreeLibrary
LoadLibraryW
CreateProcessW
GetProcAddress
GetCurrentThread
WriteConsoleA
LocalAlloc
GetOEMCP
GetACP
CompareStringW
CompareStringA
GetCPInfo
ReadFile
SetEndOfFile
LoadLibraryA
CreateFileA
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
GetModuleFileNameA
RtlUnwind
GetStartupInfoA
GetFileType
GetTimeZoneInformation
GetSystemTime
GetLocalTime
TerminateProcess
GetCurrentProcess
HeapFree
HeapReAlloc
HeapAlloc
GetModuleHandleA
GetStartupInfoW
GetVersion
GetLastError
CloseHandle
WriteFile
SetFilePointer
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
MultiByteToWideChar
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentStrings
GetCommandLineW
GetCommandLineA
SetHandleCount
GetStdHandle
SetEnvironmentVariableA

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

wininet

InternetOpenUrlA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetOpenA
HttpQueryInfoA
InternetQueryDataAvailable
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetCloseHandle
InternetGetLastResponseInfoA

Sections

.text
Size: 72KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 344KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fee819c94f618f33305707b039f05208

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

winspool.drv

wininet

Sections

.text Size: 72KB - Virtual size: 70KB

.rdata Size: 88KB - Virtual size: 84KB

.data Size: 24KB - Virtual size: 344KB

.rsrc Size: 4KB - Virtual size: 824B

.text
Size: 72KB - Virtual size: 70KB

.rdata
Size: 88KB - Virtual size: 84KB

.data
Size: 24KB - Virtual size: 344KB

.rsrc
Size: 4KB - Virtual size: 824B