2f85e6af0e390e8d1c6bc3e7b4d6b76c_JaffaCakes118

General

Target

2f85e6af0e390e8d1c6bc3e7b4d6b76c_JaffaCakes118
Size

328KB
MD5

2f85e6af0e390e8d1c6bc3e7b4d6b76c
SHA1

31ecbf452052ebe5a251d17725c52ca46fa6b756
SHA256

a1daeb62f8e924a322e3d4c9e3fa7de7c8ec3d58938078eb26543a1f24c096c6
SHA512

7acda41fb4f2a5cddcdde940407c8e98d20945516b92093c24ae4326ce03c0cb6d0bbfe8bfe8383bde132691e940a60f0cbcfdb0a05bbac44a4e18705e627448
SSDEEP

6144:IbMjnD3N/kh24lyk6JpA/aPyRZnq48r4fTxGfM8MGhlizG3zZ2XsPwHudUbR:IQDZy2CwXA/wMnqF4fdGfjr5jZ7wHud4

Score

7^/10

Malware Config

Signatures

Molebox Virtualization software 1 IoCs

Detects file using Molebox Virtualization software.

resource	yara_rule
sample	molebox

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f85e6af0e390e8d1c6bc3e7b4d6b76c_JaffaCakes118

Files

2f85e6af0e390e8d1c6bc3e7b4d6b76c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cea041f37588e49945f2c9d1fe103aea

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegOpenKeyExA
RegSetValueExA

kernel32

AddAtomA
CopyFileA
ExitProcess
FindAtomA
GetAtomNameA
GetCommandLineA
GetDriveTypeA
GetModuleFileNameA
GetModuleHandleA
GetStartupInfoA
GetWindowsDirectoryA
SetErrorMode
SetUnhandledExceptionFilter
Sleep
WritePrivateProfileStringA
lstrcpyA

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
abort
atexit
fflush
fprintf
free
malloc
memcpy
signal
strcat

user32

CreateWindowExA
MessageBoxA

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cea041f37588e49945f2c9d1fe103aea

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

user32

Sections

.text Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 768B

.rdata Size: 512B - Virtual size: 480B

.bss Size: - Virtual size: 1KB

.idata Size: 1KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 2KB

.adata Size: 72KB - Virtual size: 72KB

.text
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 768B

.rdata
Size: 512B - Virtual size: 480B

.bss
Size: - Virtual size: 1KB

.idata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB

.adata
Size: 72KB - Virtual size: 72KB