3535507e5c42a9c54ce81b7be1cfba88_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

3535507e5c42a9c54ce81b7be1cfba88_JaffaCakes118
Size

62KB
MD5

3535507e5c42a9c54ce81b7be1cfba88
SHA1

0a9d09b69f04cc36d834040a4c3c883d965beeaf
SHA256

868d2d6635ece2497915d8d932ecc69c5f207c348d622aad9390eae0af681e8d
SHA512

2b6231d802a1de10b64d144314044d531f8d2b59eb3ae780eda4d718cb9c3bf7d2b21a5751346c890669396cb608c22617d0e3c383d86468b778b3ed86d33252
SSDEEP

1536:5n/1AvVIJjOf9OalanJBAZAEqroSKVvz:5/1yIJifYalanJBAkcH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3535507e5c42a9c54ce81b7be1cfba88_JaffaCakes118

Files

3535507e5c42a9c54ce81b7be1cfba88_JaffaCakes118
.exe windows:5 windows x86 arch:x86

deed2fc56f92d2a6596c6b44bbf7f645

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\srv03qfe\base\ntsetup\srvpack.MAIN\tools\qfecheck\obj\i386\qfecheck.pdb

Imports

advapi32

RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey

kernel32

UnmapViewOfFile
CloseHandle
LoadResource
SetLastError
GetLastError
FindResourceA
MapViewOfFileEx
CreateFileMappingA
CreateFileA
DeleteFileA
SetFileAttributesA
LocalFree
LocalAlloc
WriteFile
SetFilePointer
FreeLibrary
LoadLibraryA
GetProcAddress
GetModuleFileNameA
GetFileAttributesA
GetComputerNameA
GetSystemDirectoryA
GetVersionExA
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
ExitProcess
GetModuleHandleA
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedExchange
VirtualQuery
MultiByteToWideChar
LCMapStringA
LCMapStringW
Sleep
VirtualProtect
GetSystemInfo
GetACP
GetOEMCP
GetCPInfo
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
FlushFileBuffers
SetStdHandle

user32

LoadStringA

ntdll

RtlSystemTimeToLocalTime
RtlTimeToTimeFields
NtQuerySystemTime

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

deed2fc56f92d2a6596c6b44bbf7f645

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

ntdll

version

Sections

.text Size: 29KB - Virtual size: 28KB

.data Size: 2KB - Virtual size: 9KB

.rsrc Size: 30KB - Virtual size: 31KB

.text
Size: 29KB - Virtual size: 28KB

.data
Size: 2KB - Virtual size: 9KB

.rsrc
Size: 30KB - Virtual size: 31KB