33544b0e03622dc3be74b6e5c1d13fa1_JaffaCakes118

General

Target

33544b0e03622dc3be74b6e5c1d13fa1_JaffaCakes118
Size

10KB
MD5

33544b0e03622dc3be74b6e5c1d13fa1
SHA1

ea71a173080da9246cf761a738488591264e2551
SHA256

330f8fa97022d0b9e20d77fd8310f82724fb82e87d6d91c3e81776cdb5321c56
SHA512

13f4cd05dd9a99054e4074d8ad264ca7d44121d11c3277ecfb1f75ebbc6874c661573427c7892bd212877aa028014050c9ef0b4d7d5ce54242842d9720c5bb76
SSDEEP

192:GOtd6L4jViWbWqHjfEIDoI3ScS/qsGPPbHLhrTwr/v/KKI:GQU4jVzbFHjMvItS2rHLur/KZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
33544b0e03622dc3be74b6e5c1d13fa1_JaffaCakes118

Files

33544b0e03622dc3be74b6e5c1d13fa1_JaffaCakes118
.dll windows:4 windows x86 arch:x86

4ccd15710ac944fb3dde7609cf325e21

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

cygwin1

_impure_ptr
abort
calloc
cygwin_detach_dll
cygwin_internal
dll_dllcrt0
free
malloc
memcpy
memmove
realloc
select
strcmp
strlen
syslog
vsnprintf

kernel32

GetModuleHandleA
GetProcAddress

Exports

Exports

heim_abort
heim_alloc
heim_array_append_value
heim_array_copy_value
heim_array_create
heim_array_delete_value
heim_array_get_length
heim_array_iterate_f
heim_auto_release
heim_auto_release_create
heim_auto_release_drain
heim_base_once_f
heim_cmp
heim_dict_add_value
heim_dict_copy_value
heim_dict_create
heim_dict_delete_key
heim_dict_iterate_f
heim_number_create
heim_release
heim_retain
heim_string_create
heim_string_get_utf8

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/4
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 717B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4ccd15710ac944fb3dde7609cf325e21

Headers

File Characteristics

Imports

cygwin1

kernel32

Exports

Exports

Sections

.text Size: 5KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 880B

/4 Size: 512B - Virtual size: 4B

.bss Size: - Virtual size: 1KB

.edata Size: 1024B - Virtual size: 717B

.idata Size: 1024B - Virtual size: 568B

.reloc Size: 512B - Virtual size: 336B

.text
Size: 5KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 880B

/4
Size: 512B - Virtual size: 4B

.bss
Size: - Virtual size: 1KB

.edata
Size: 1024B - Virtual size: 717B

.idata
Size: 1024B - Virtual size: 568B

.reloc
Size: 512B - Virtual size: 336B