38d2f4113d604b31f0d30a81a5f687eb_JaffaCakes118

General

Target

38d2f4113d604b31f0d30a81a5f687eb_JaffaCakes118
Size

81KB
MD5

38d2f4113d604b31f0d30a81a5f687eb
SHA1

f41c35010dfe647bc53754142eb7b3e6e61065c0
SHA256

9a2198f98fb11f10741414a1e1b1247bf43c7e3c8f9b3c4cd1cd34d5d842ce75
SHA512

7e6f7044fadac6e897e610bad18a5b7852aef16f35c82ea1b9d23ea81d21ef3d0e36dbf49211e2d63e12285752a5a31cba770a28ff43c5f56412b48c4c5d61ba
SSDEEP

1536:e7y7pG4vKBpI87xNNdwpaG4lmO8sdBWOdgZH1sf9ad0YAGBDU:FtGgKBpvfd+14/dBdda8Y6b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
38d2f4113d604b31f0d30a81a5f687eb_JaffaCakes118

Files

38d2f4113d604b31f0d30a81a5f687eb_JaffaCakes118
.exe windows:4 windows x86 arch:x86

59b90ff6e3afcd3a7cdb661754e4d53d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AddAtomA
CreateProcessA
CreateRemoteThread
ExitProcess
FindAtomA
FindResourceA
FreeResource
GetAtomNameA
GetCommandLineA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetThreadContext
HeapAlloc
HeapFree
LoadLibraryA
LoadResource
LockResource
ReadProcessMemory
ResumeThread
SetThreadContext
SetUnhandledExceptionFilter
TerminateProcess
VirtualAlloc
VirtualFree
VirtualFreeEx
VirtualProtect
VirtualProtectEx
VirtualQuery
WaitForSingleObject
WriteProcessMemory

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_iob
_onexit
_setmode
abort
atexit
free
malloc
memcpy
signal

ntdll

NtAllocateVirtualMemory
NtFlushInstructionCache
NtFreeVirtualMemory
NtProtectVirtualMemory
NtQueryVirtualMemory
NtUnmapViewOfSection
RtlImageNtHeader
_snprintf

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 96B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

59b90ff6e3afcd3a7cdb661754e4d53d

Headers

File Characteristics

Imports

kernel32

msvcrt

ntdll

Sections

.text Size: 7KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 16B

.rdata Size: 1024B - Virtual size: 736B

.bss Size: - Virtual size: 96B

.idata Size: 2KB - Virtual size: 1KB

.rsrc Size: 3.2MB - Virtual size: 3.2MB

.text
Size: 7KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 16B

.rdata
Size: 1024B - Virtual size: 736B

.bss
Size: - Virtual size: 96B

.idata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 3.2MB - Virtual size: 3.2MB