2952e688875b3d6c59e37eebae869f61_JaffaCakes118

General

Target

2952e688875b3d6c59e37eebae869f61_JaffaCakes118
Size

2.1MB
MD5

2952e688875b3d6c59e37eebae869f61
SHA1

5c185922ae84e0b6cf0d43afcee4286d7066ef13
SHA256

2be92689e3cfc1164a2f314441ee65f1c0a2a8ab252ac3650a9b561aa0d1e86e
SHA512

7c97336b064f6102bfbb5a8a61e5462500556dc32406896344fc31bb8364f9e313fe86be6a4d3bdcc7d3fb271960f6115dec8466a85c76e97e2a240ea3605f8b
SSDEEP

12288:6bH11sgJVJM74ZJhl8p4QkfMvfZ+RPIoGwxsBt49Zp9PQamrdtcEiP/3IWVz/6cQ:6bHblJxnlikfqZu7tsgQZrc/QJfB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2952e688875b3d6c59e37eebae869f61_JaffaCakes118

Files

2952e688875b3d6c59e37eebae869f61_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5ea6d6db4da45b10fc7d191de9679c55

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesA
GetTempFileNameA
CopyFileA
GetShortPathNameA
GetEnvironmentVariableA
WaitForMultipleObjects
InterlockedCompareExchange
InterlockedDecrement
lstrlenA
SetTapePosition
VirtualProtect
CloseHandle
Module32First
CreateToolhelp32Snapshot

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA
EnumPrintersA

ws2_32

WSAAddressToStringA
WSASocketA
WSACreateEvent
WSAConnect
WSAWaitForMultipleEvents
WSAEnumNetworkEvents

version

GetFileVersionInfoSizeA
VerQueryValueA

msvcrt

__dllonexit
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_onexit
__p___initenv
_XcptFilter
_exit
exit
fclose
fread
fseek
fopen
free
malloc
localtime

Sections

.text
Size: 324KB - Virtual size: 322KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 172KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 220KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5ea6d6db4da45b10fc7d191de9679c55

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

winspool.drv

ws2_32

version

msvcrt

Sections

.text Size: 324KB - Virtual size: 322KB

.rdata Size: 172KB - Virtual size: 170KB

.data Size: 220KB - Virtual size: 1.1MB

.tls Size: 4KB - Virtual size: 100B

.rsrc Size: 8KB - Virtual size: 6KB

.text
Size: 324KB - Virtual size: 322KB

.rdata
Size: 172KB - Virtual size: 170KB

.data
Size: 220KB - Virtual size: 1.1MB

.tls
Size: 4KB - Virtual size: 100B

.rsrc
Size: 8KB - Virtual size: 6KB