3702826f28b6dbec9809a40b1b5a8449_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3702826f28b6dbec9809a40b1b5a8449_JaffaCakes118
Size

1.2MB
MD5

3702826f28b6dbec9809a40b1b5a8449
SHA1

b88154eeba5be0310a6e3c01911ac11587e3e81e
SHA256

7a3c61121d9d73082010a307ab0918100f9b00e5c2e289d033c4bbf4e7941a2d
SHA512

a08628e1797c41445f914796919a015431263f69978c8ce65d4d988c176c319de2fa70ad457f00a138baf5392153e9b8ac1f926cd22d319e44c50912446549da
SSDEEP

12288:D/pCkDZs109IyeUz9XmJpw1aNLIHRbZSPzCeWNLXttF4LDchBo+jif/vFr/Za:D/pgrPUzNm7CZx4upNLdryDc6/vFrxa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3702826f28b6dbec9809a40b1b5a8449_JaffaCakes118

Files

3702826f28b6dbec9809a40b1b5a8449_JaffaCakes118
.dll windows:4 windows x86 arch:x86

e774bc3ae52c42b4036784b8d8368a46

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

o.pdb

Imports

kernel32

ExitProcess
SetEvent
SetCurrentDirectoryW
GetSystemDirectoryW
SetLastError
ExpandEnvironmentStringsW
GetStartupInfoW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
FindFirstFileW
FindClose
GetLocalTime
CreateThread
DeviceIoControl
SetErrorMode
GetVolumeInformationW
GetDiskFreeSpaceW
GetCommandLineW
GetDriveTypeW
SetVolumeLabelW
GetEnvironmentVariableW
Sleep
CloseHandle
SetStdHandle
SetConsoleCtrlHandler
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
FlushFileBuffers
SetFilePointer
GetLastError
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
LCMapStringW
LCMapStringA
MultiByteToWideChar
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
lstrcpyA
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetModuleFileNameA
GetModuleHandleA
GetVersion
GetCommandLineA
RtlUnwind
GetDriveTypeA
GetFullPathNameA
GetCurrentDirectoryA
GetCurrentProcess
ExitThread

msvcrt

memset

Exports

Exports

cugvi

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e774bc3ae52c42b4036784b8d8368a46

Headers

File Characteristics

PDB Paths

Imports

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 16KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 1.2MB - Virtual size: 1.2MB

.rsrc Size: 4KB - Virtual size: 880B

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 20KB - Virtual size: 16KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 1.2MB - Virtual size: 1.2MB

.rsrc
Size: 4KB - Virtual size: 880B

.reloc
Size: 4KB - Virtual size: 2KB