2bbc1efbdb3caccdd17c2aa5b10cdb6e_JaffaCakes118

General

Target

2bbc1efbdb3caccdd17c2aa5b10cdb6e_JaffaCakes118
Size

183KB
MD5

2bbc1efbdb3caccdd17c2aa5b10cdb6e
SHA1

82336eb5003fff00842500552a77d3a1ab5e2362
SHA256

24ce7b15b17dd21635a0e1d6cb2dc3324126a1d5e63a623957785fdc269815ca
SHA512

afc186ba55c5fab471da8bbfdbb0fcb639cdf38f745502234cae220c31d70f9d36c9bd82130ac07e2cf501418cc7c05f943a523a9f9986a8a29ece54bace90ae
SSDEEP

3072:bXkOgt0fx72jiDi0vTBSFsnCkj1j+isTWn+StggX4c/yEY/c/TzHVy8ogcWZGldm:YOgt+xgiLvTBSFQtjnsTQRtFX4c2c/nV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2bbc1efbdb3caccdd17c2aa5b10cdb6e_JaffaCakes118

Files

2bbc1efbdb3caccdd17c2aa5b10cdb6e_JaffaCakes118
.dll windows:4 windows x86 arch:x86

e01c8144f56fc1ea70e7b1c2d9706f49

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\perforce\software\whitehawk\ReceiveFaxUtility\languages\release\Receive_ES.pdb

Imports

mfc80u

ord1168
ord1170
ord1192
ord1200
ord581
ord1115
ord1162
ord1908
ord371
ord1093
ord1199
ord1197
ord1087
ord1033
ord1079
ord764
ord315
ord765
ord6751
ord314

msvcr80

_except_handler4_common
__clean_type_info_names_internal
__CxxFrameHandler3
??2@YAPAXI@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer

kernel32

UnhandledExceptionFilter
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
LocalAlloc
LocalFree
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCurrentThreadId

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 172KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e01c8144f56fc1ea70e7b1c2d9706f49

Headers

File Characteristics

PDB Paths

Imports

mfc80u

msvcr80

kernel32

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 172KB - Virtual size: 173KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 1024B - Virtual size: 688B

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 172KB - Virtual size: 173KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1024B - Virtual size: 688B