2beff7372bf7c981ece5d1bedef54568_JaffaCakes118

General

Target

2beff7372bf7c981ece5d1bedef54568_JaffaCakes118
Size

146KB
MD5

2beff7372bf7c981ece5d1bedef54568
SHA1

813e6efd3faf43a76678b5ac88f7266028dafd2a
SHA256

38022eb3ede7a13de716ee841dee3dce0c674cc1e387e1175030b9d3b1849da4
SHA512

94b883747fef0ae5d11ce17baabbbedff944cadd2636678a23118163075943acea338640c6bbbe8457f4b9a7144a35db8246da94a983c75364e6571afe3f4851
SSDEEP

3072:8TtaDqO0k7R0UHe+777777777uVd5srl1t4+6xf7777777778GidLVo0Xz/of6S1:8TG6JYt4+6x7r

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2beff7372bf7c981ece5d1bedef54568_JaffaCakes118

Files

2beff7372bf7c981ece5d1bedef54568_JaffaCakes118
.exe windows:5 windows x86 arch:x86

daa7e1d86d81342bda9d511f9bcdd4de

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
ReadFile
SetFilePointer
GetFileSize
CreateFileA
GetModuleFileNameA
GetProcessHeap
GetModuleHandleA
HeapFree
LCMapStringW
HeapAlloc
ExitProcess
CloseHandle
LCMapStringA
GetStringTypeW
LoadLibraryA
ContinueDebugEvent
lstrlenA
GetProcAddress
GetModuleHandleW
Sleep
RtlUnwind
RaiseException
GetLastError
GetCommandLineA
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WriteFile
GetStdHandle
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar

winspool.drv

AddPrinterDriverA

comdlg32

FindTextA
GetOpenFileNameA

advapi32

AddUsersToEncryptedFile

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

daa7e1d86d81342bda9d511f9bcdd4de

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

winspool.drv

comdlg32

advapi32

Sections

.text Size: 48KB - Virtual size: 47KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 10KB - Virtual size: 10KB

.text
Size: 48KB - Virtual size: 47KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 10KB - Virtual size: 10KB