3403e654f42ee65fb813e464e2953e8f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3403e654f42ee65fb813e464e2953e8f_JaffaCakes118
Size

424KB
MD5

3403e654f42ee65fb813e464e2953e8f
SHA1

952e039c2e8c24f6c932b3f25033614ac3461ec8
SHA256

0983a7cac8db8684f2d0611a9aca1eca830fe019b9b59b996d69d708db4a7a6e
SHA512

c833274ec750d3951f22dc23fbc3331c299b52376c59b8ec3916ce2687976c0ea7c1e30fa829448e475c379ae91ae598bc703e8c52f2e51e49a4e3a1db6f50c0
SSDEEP

12288:dkdGr8Vezlmi3lHbI2MBTad+sp/jK9wb+Ha:udGr8qlmi9bI2LdrpLo6O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3403e654f42ee65fb813e464e2953e8f_JaffaCakes118

Files

3403e654f42ee65fb813e464e2953e8f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

aa0ce1405bb179d09677083305f64dce

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
WriteFile
SetEvent
GetTickCount
GetProcAddress
GetLastError
GetModuleHandleA
LoadLibraryA
InterlockedExchange
Sleep
lstrcatA
ResetEvent
CloseHandle
FlushFileBuffers
SetStdHandle
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
DebugBreak
GetStdHandle
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
GetModuleFileNameA
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
VirtualFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
RtlUnwind
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
SetFilePointer
LCMapStringA
LCMapStringW

user32

LoadBitmapA
GetClientRect
PostMessageA
GetActiveWindow
GetFocus
ShowWindow

msvfw32

ICClose

winmm

joyGetPosEx
joyGetDevCapsA
joySetThreshold

Exports

Exports

?Loader@@YAKKK@Z

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 156KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 204KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 8KB - Virtual size: 389KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aa0ce1405bb179d09677083305f64dce

Headers

File Characteristics

Imports

kernel32

user32

msvfw32

winmm

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 38KB

.rdata Size: 156KB - Virtual size: 152KB

.data Size: 204KB - Virtual size: 209KB

.tls Size: 8KB - Virtual size: 389KB

.rsrc Size: 12KB - Virtual size: 9KB

.text
Size: 40KB - Virtual size: 38KB

.rdata
Size: 156KB - Virtual size: 152KB

.data
Size: 204KB - Virtual size: 209KB

.tls
Size: 8KB - Virtual size: 389KB

.rsrc
Size: 12KB - Virtual size: 9KB