3f04b750232d15a9fe12c644ce77efe5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3f04b750232d15a9fe12c644ce77efe5_JaffaCakes118
Size

178KB
MD5

3f04b750232d15a9fe12c644ce77efe5
SHA1

6c08ecbffe112f73edb98110b759a93f687c2415
SHA256

5474ff792df6210f65b59b07b72850c8ee1e3069ff867017cf4609e08ee558d4
SHA512

7f439b21dd1e16b677a7b6b5ff5af006d99e7cdf92448c07d45736c49395e34cf51d2d071247c611269096d2cf9b6e51d7a507a61ef3f1ad06ebcbb37ec9cab7
SSDEEP

3072:gp+4BbIQ1zqjBfDKTVMWccXzAqcy0QNhmLhowhX2GTW4USXR3Z45iaEQt+WwxtLG:t491yBrKxjcSP0QNhmLhowFHV1JC593D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f04b750232d15a9fe12c644ce77efe5_JaffaCakes118

Files

3f04b750232d15a9fe12c644ce77efe5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4a2a0333b0571cf6f46a282d8f3dfe02

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Work\Product\Releases\61.6.00.00\InduSoft Web Studio\ReleaseUnicode\StdSvc.pdb

Imports

mfc80u

ord4026
ord293
ord577
ord566
ord757
ord266
ord265
ord764
ord1479
ord282
ord2310
ord6700
ord5398
ord2460
ord1906
ord5485
ord5524
ord6161
ord774
ord1197

msvcr80

_controlfp_s
_invoke_watson
_except_handler4_common
_crt_debugger_hook
?terminate@@YAXXZ
__set_app_type
__p__fmode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__winitenv
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
wcscpy_s
__p__commode
__CxxFrameHandler3

kernel32

GetCurrentProcessId
GetModuleFileNameW
GetLastError
TerminateJobObject
OpenJobObjectW
GetModuleHandleW
GetCommandLineW
Sleep
TerminateProcess
FormatMessageW
GetPrivateProfileStringW
FindFirstFileW
FindClose
CreateJobObjectW
CreateProcessW
AssignProcessToJobObject
ResumeThread
CloseHandle
GetTickCount
InterlockedExchange
InterlockedCompareExchange
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
OpenProcess
GetCurrentThreadId

user32

LoadStringW
FindWindowW
PostMessageW
GetWindowThreadProcessId

advapi32

DeregisterEventSource
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterEventSourceW
ReportEventW

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PACK
Size: 164KB - Virtual size: 424KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4a2a0333b0571cf6f46a282d8f3dfe02

Headers

File Characteristics

PDB Paths

Imports

mfc80u

msvcr80

kernel32

user32

advapi32

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 2KB

PACK Size: 164KB - Virtual size: 424KB

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB

PACK
Size: 164KB - Virtual size: 424KB