38edb51ad2b46b0ec62158823f0412d8_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

38edb51ad2b46b0ec62158823f0412d8_JaffaCakes118
Size

85KB
MD5

38edb51ad2b46b0ec62158823f0412d8
SHA1

f4451b6925326a5f9654e04dc9917eda6c2680bd
SHA256

69fe5777f51da82b6fd373493286b70d2654e95e233d79b3895ac040497e657a
SHA512

c37829a0314fdc8aed1c307f1a3d73ec0ba087e7b6f7a085349a5f74880b7e62a4380636784556f180233e654842e24436376357d883140d377af6e59f0db6e6
SSDEEP

1536:7FQiSBxCY3ylGtOvzkWEBU9pzjSXQDFQCV1UsF5W8S8V7iEdf3pCAffE:QBxCDvzkTBU3SgK/sF5W8JtfpDffE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/wpjq2.bin

Files

38edb51ad2b46b0ec62158823f0412d8_JaffaCakes118
.zip

Password: infected
wpjq2.bin
.exe windows:5 windows x86 arch:x86

63b0807d7e1c3cdc3c07b22a7877c51a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetPriorityClass
lstrlenA
GetCommState
CancelWaitableTimer
ConnectNamedPipe
CallNamedPipeW
SetTapeParameters
GetModuleHandleW
IsBadReadPtr
Sleep
GetPrivateProfileStructW
SizeofResource
GetFileAttributesA
ReadFile
lstrcatA
RaiseException
SetDefaultCommConfigA
FreeLibraryAndExitThread
SetLastError
GetProcAddress
SearchPathA
GetLocalTime
LoadLibraryA
LocalAlloc
BuildCommDCBAndTimeoutsW
SetFileApisToANSI
FindAtomA
GetOEMCP
_lread
FreeEnvironmentStringsW
GetCurrentDirectoryA
EnumResourceNamesW
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
GetStartupInfoW
GetCPInfo
RtlUnwind
LCMapStringW
LCMapStringA
GetStringTypeW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetCurrentProcessId
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
CloseHandle
CreateFileA
HeapCreate
VirtualFree
VirtualAlloc
ExitProcess
WriteFile
GetModuleFileNameA
GetModuleFileNameW
GetEnvironmentStringsW
GetCommandLineW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetStringTypeA
HeapSize
GetACP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetConsoleCP
GetConsoleMode
SetFilePointer
SetEndOfFile
GetProcessHeap
GetLocaleInfoW
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

Exports

Exports

_ifgeek@8

Sections

.text
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 43.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

63b0807d7e1c3cdc3c07b22a7877c51a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 105KB - Virtual size: 104KB

.rdata Size: 17KB - Virtual size: 16KB

.data Size: 7KB - Virtual size: 43.5MB

.rsrc Size: 13KB - Virtual size: 12KB

.text
Size: 105KB - Virtual size: 104KB

.rdata
Size: 17KB - Virtual size: 16KB

.data
Size: 7KB - Virtual size: 43.5MB

.rsrc
Size: 13KB - Virtual size: 12KB