386c23601dc7e0bb8761b9f52f31be63_JaffaCakes118

General

Target

386c23601dc7e0bb8761b9f52f31be63_JaffaCakes118
Size

32KB
MD5

386c23601dc7e0bb8761b9f52f31be63
SHA1

52d15a534d79d9d4136ce08121cade044ee4eea4
SHA256

0c970bc19b6147b5c9e979ad5a8cef9f9c18919b033b3146472fd18c7ace822e
SHA512

f2b34ba21b7fa1aa61d23099017cecc05bb70c2dd768f5b619ffddca0b4487c431997e06295adbb1681034e9e0b651e692d434d542473dd04279c496bd106c94
SSDEEP

384:RSy7bbo1jd6ovmlyEsE2yynsCGalXh6oZSnMqzgnpr:RHU1ootE4yvCGaJh6oHr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
386c23601dc7e0bb8761b9f52f31be63_JaffaCakes118

Files

386c23601dc7e0bb8761b9f52f31be63_JaffaCakes118
.exe windows:4 windows x86 arch:x86

04833b6319dece836817111947c202ba

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

bc32fn

AllocLocalData
pvTerminateProgram
FreeLocalData
DBDatabase
DBClose
BcMain2
DBXAccess
BcxExit
ZPREXTEND
bPrintFileName
bGetActualArgsExv
ZEXVARG
PropertiesEx
ZTRADVER
ZMINVER
ZMINVERUX
pszCurrentModule
CallDllFunction2
bOptimizeSearch
iNewFrmSpec
pszSUBProto
psArgv
iArgc
CallAllPrograms
PROGC
ZNOMEXE

bc32ui

pszDecodMessage
SYSANNOEXT
DBCreateVars2
DBDefineStructs
EntryInitProgramData
cRowsRI
cColsRI
RI
KYM
ExitInitProgramData
EntryTerminateProgram
DBRemoveVars
RCCHAN
WgsInitData
ExitTerminateProgram
szProgramName
RCSRCH
SearchSTR
WgsExitAppThread
WgsInitID
CANVID

kernel32

SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
GetCurrentProcess
TerminateProcess
ExitProcess
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
HeapReAlloc
VirtualAlloc
GetStdHandle

Sections

.text
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

04833b6319dece836817111947c202ba

Headers

File Characteristics

Imports

bc32fn

bc32ui

kernel32

Sections

.text Size: 16KB - Virtual size: 13KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 792B

.text
Size: 16KB - Virtual size: 13KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 792B