2c0aabe6cdcf0d60e2115b3e10101409_JaffaCakes118

General

Target

2c0aabe6cdcf0d60e2115b3e10101409_JaffaCakes118
Size

592KB
MD5

2c0aabe6cdcf0d60e2115b3e10101409
SHA1

a1601bc711bcf4908531aa1de3276c6d453fc1a9
SHA256

608abdf2232bb919db79203fe9792abb0b994881bac41f7d124c46c08bef92cd
SHA512

bf8ab77663bb26a5d6fedfb74467fce54628e24ebc86241c7dfb23b14d72066aeea0388edf78dccb90e86e025026e3816b1ed0d56c45c7f299bfdd9c4fe949cd
SSDEEP

12288:oWuhme/WPMeqFqxGlO8Gp60TzsGEQmU43OjF+t/opi6uHEph8eJSiJt:qhB/W0FplO8GEOEXUhjFQAzWEph8eIi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2c0aabe6cdcf0d60e2115b3e10101409_JaffaCakes118

Files

2c0aabe6cdcf0d60e2115b3e10101409_JaffaCakes118
.exe windows:5 windows x86 arch:x86

4e40ebb1d5ab75fd2ef5308f341e3a6f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

userenv

EnterCriticalPolicySection
RegisterGPNotification

version

VerFindFileA
GetFileVersionInfoA
VerQueryValueA
VerQueryValueW
VerInstallFileW

rpcrt4

data_size_ndr
RpcSmSwapClientAllocFree
RpcServerUseProtseqEpA
RpcServerUseAllProtseqsIf
RpcServerUnregisterIf
RpcNetworkIsProtseqValidA
MesHandleFree
CStdStubBuffer_AddRef

kernel32

WinExec
WaitNamedPipeW
VirtualFree
VirtualAlloc
VerLanguageNameA
UnlockFileEx
SetVolumeMountPointW
SetUnhandledExceptionFilter
SetLastError
SetComputerNameA
OpenMutexA
CallNamedPipeW
ConvertThreadToFiber
CreateNamedPipeW
EnterCriticalSection
EnumTimeFormatsA
ExitProcess
FindResourceA
GetACP
GetCPInfo
GetCommandLineA
GetNamedPipeHandleStateW
GlobalDeleteAtom
HeapAlloc
IsProcessorFeaturePresent
LocalFlags

crtdll

_ismbcprint
_ultow
_wcslwr
atan2
_finite
iswgraph
localtime
_expand
_exit
_XcptFilter
_heapchk

ntdll

RtlNtStatusToDosError
RtlQueryTimeZoneInformation
RtlSetAttributesSecurityDescriptor
RtlStartRXact
RtlpNtSetValueKey
ZwFindAtom
RtlInitializeCriticalSection
RtlCompareUnicodeString
NtReplyPort
RtlNewSecurityGrantedAccess

Exports

Exports

Yzlzl
bakleqmhxsYjnk
eemQpzMMV
hpgrCbuadnim
iohiaAfawormdXcho
mywxoludr
oJilxyvscfmdjbxpcC
okyxXfZfhpLFqofEp
pbygtuUMwqaxsnnlv
rmtXsw
tBcdzqkoc
vcqptNooPjGx
vrsqD
yfyvBYdbwkl

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 505KB - Virtual size: 507KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4e40ebb1d5ab75fd2ef5308f341e3a6f

Headers

File Characteristics

Imports

userenv

version

rpcrt4

kernel32

crtdll

ntdll

Exports

Exports

Sections

.text Size: 34KB - Virtual size: 33KB

.data Size: 505KB - Virtual size: 507KB

.rsrc Size: 51KB - Virtual size: 51KB

.text
Size: 34KB - Virtual size: 33KB

.data
Size: 505KB - Virtual size: 507KB

.rsrc
Size: 51KB - Virtual size: 51KB