30a7aa13b1f8d272cb36576952e8b6c0_JaffaCakes118

General

Target

30a7aa13b1f8d272cb36576952e8b6c0_JaffaCakes118
Size

294KB
MD5

30a7aa13b1f8d272cb36576952e8b6c0
SHA1

ee047ef34d2202e1e01104f9563761880e99729a
SHA256

010f36d6b66747e906c8f7025df1e154ceabc598f9c1d91357a97f89af0c0cda
SHA512

fc4549d7510c65badfaf58a37304f9b911ab8b2dc4a94215e1897989783eda775c0ac423ba1ce12332fcff0f559f0c23087fd437a059bf6c3ed5d3a0cbe83210
SSDEEP

6144:1mRIUe5JVxpPa2Js3VgtspgPpnYB78eGFfWND1CJQHSByT8Tn:1oq5JVxpPa2JCVglCB78r4RxHzT8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
30a7aa13b1f8d272cb36576952e8b6c0_JaffaCakes118

Files

30a7aa13b1f8d272cb36576952e8b6c0_JaffaCakes118
.exe .pdf windows:4 windows x86 arch:x86 polyglot

293741ea8e458644ab6b51e3e5150c58

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateDirectoryA
ExpandEnvironmentStringsA
WaitForSingleObject
GetStartupInfoA
SetCurrentDirectoryA
WriteFile
FreeResource
GetTickCount
SizeofResource
LoadResource
FindResourceA
GetModuleHandleA
ReadFile
lstrcpyA
IsDebuggerPresent
LoadLibraryA
GetProcAddress
CreateProcessA
ExitProcess
GetModuleFileNameA
WinExec
DeleteFileA
Sleep
CloseHandle
CreateFileA
GetLastError

advapi32

RegQueryValueExA
RegCloseKey
CryptEncrypt
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptDestroyHash
CryptDecrypt
RegOpenKeyA

shell32

ShellExecuteA

lz32

LZOpenFileA
LZClose
LZCopy

msvcrt

strncmp
free
fclose
fwrite
fread
malloc
fopen
_beginthreadex
strstr
ftell
fseek
sprintf
printf
memmove
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 278KB - Virtual size: 277KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

293741ea8e458644ab6b51e3e5150c58

Headers

File Characteristics

Imports

kernel32

advapi32

shell32

lz32

msvcrt

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 278KB - Virtual size: 277KB

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 278KB - Virtual size: 277KB