2b0f0743095da9084be6c013456e59bd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2b0f0743095da9084be6c013456e59bd_JaffaCakes118
Size

87KB
MD5

2b0f0743095da9084be6c013456e59bd
SHA1

39ccb63127eb1153fbaeca01169c3bcc2e975144
SHA256

44aea18beed7ec4bafdb7a316e765d57b16c9e5c577431281b82bdf05d88b774
SHA512

8c171c62ef8d80240669ad1bd93228ff8ade8c766d2f5b114b02ce83de30367476f94a78f57ec40416c951688f4d8540c15ce4cdbca0aee40bbb4082f5d18d38
SSDEEP

1536:u2SufS/Bj5hi92/IKlYfZyFgbP7AqP/J6yMk79eyHMc95U:u2dfYfY9+KxTD//9TDK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b0f0743095da9084be6c013456e59bd_JaffaCakes118

Files

2b0f0743095da9084be6c013456e59bd_JaffaCakes118
.exe windows:5 windows x86 arch:x86

5be938b75a43dfffe059c32e4d6174dd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ir50_qc

CompressEnd
SetCPUID
CompressFramesInfo
AllocInstanceData
SetScalability
Compress
CompressQuery
FreeInstanceData
CompressBegin
DllMain

keymgr

DllMain
KRShowKeyMgr
PRShowRestoreWizardW
PRShowRestoreFromMsginaW
CPlApplet
PRShowRestoreWizardExW
PRShowSaveFromMsginaW
PRShowSaveWizardExW

kernel32

CreateFileA
GetNumberFormatW
ReadConsoleOutputA
LoadLibraryA
GetSystemTimeAsFileTime
QueryDosDeviceW
SetProcessPriorityBoost
FindFirstFileA
PeekNamedPipe
SetCommConfig
GlobalHandle
GetLongPathNameW
ReadDirectoryChangesW
GetACP
SetCurrentDirectoryW
FindFirstFileW
UnregisterWait
IsProcessInJob
DeviceIoControl
GetConsoleFontSize
QueryPerformanceCounter
GetNextVDMCommand
TerminateThread
GetTickCount
GetCPInfoExW
IsValidCodePage
CreateTimerQueueTimer
VirtualAlloc
GetConsoleOutputCP
GetCurrentProcessId
ReleaseActCtx
IsBadHugeWritePtr
EnumUILanguagesA
GetCurrentThreadId
GetCurrencyFormatW
GetSystemPowerStatus
DebugBreak
ReadConsoleOutputAttribute

dbghelp

SymUnDName
SymUnDName64
FindExecutableImage
SymGetModuleInfoW
SymUnloadModule64
ImageDirectoryEntryToData
ImageRvaToVa
SymGetSymFromName64
SymGetModuleBase
SymEnumerateSymbols
FindFileInSearchPath
SymRegisterFunctionEntryCallback
srcfiles
SymEnumerateSymbolsW64
ImageNtHeader

Sections

.text
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5be938b75a43dfffe059c32e4d6174dd

Headers

DLL Characteristics

File Characteristics

Imports

ir50_qc

keymgr

kernel32

dbghelp

Sections

.text Size: 41KB - Virtual size: 41KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 21KB - Virtual size: 26KB

.rsrc Size: 21KB - Virtual size: 20KB

.reloc Size: 512B - Virtual size: 384B

.text
Size: 41KB - Virtual size: 41KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 21KB - Virtual size: 26KB

.rsrc
Size: 21KB - Virtual size: 20KB

.reloc
Size: 512B - Virtual size: 384B