3dd992ebd3c6ee1f51466ea02da50653_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3dd992ebd3c6ee1f51466ea02da50653_JaffaCakes118
Size

208KB
MD5

3dd992ebd3c6ee1f51466ea02da50653
SHA1

4be66ed027d9037e0726fd98f2a00acd93069815
SHA256

aaf7601540d4a5a493f3789f8759b0757d8ebf420d5fd0e0058b95addaec30a0
SHA512

42f358f36fa3240f07a289db11aabec32ffa3a906ecd5017f58f461a88cc46694fe584ba3a1868ab833b5caeaed1a099fae6bff764dd52226b2918714ecc04b1
SSDEEP

3072:52HfMNspRlc5SgDnIgdOi4SFNwmfJgELLbeTaXMAzUKYdBpyPi9ga8c:52uspkzn3dT4SFV7Lj8AzVjYg2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3dd992ebd3c6ee1f51466ea02da50653_JaffaCakes118

Files

3dd992ebd3c6ee1f51466ea02da50653_JaffaCakes118
.exe windows:5 windows x86 arch:x86

829dda6505a15e92aa46ecca7b92cb76

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Documents and Settings\Frk7IT\Desktop\Frk7Crypter2\Stubsmall\Release\Stub.pdb

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
lstrcpyA
lstrlenA
GetCommandLineA
CloseHandle
lstrcmpA
Sleep
GetSystemTime
GetTickCount
ReadFile
GetModuleFileNameA
ExitProcess
WriteFile
SetFileAttributesA
CopyFileA
GetLastError
DeleteFileA
lstrcatA
GetModuleHandleA
GetProcAddress
LoadLibraryA
VirtualProtect
VirtualAlloc
CreateMutexA
HeapSetInformation
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
RaiseException
GetModuleHandleW
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
HeapReAlloc
LCMapStringW
MultiByteToWideChar
GetStringTypeW

shell32

ShellExecuteA
SHGetSpecialFolderPathA

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

829dda6505a15e92aa46ecca7b92cb76

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shell32

Sections

.text Size: 24KB - Virtual size: 23KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 47KB - Virtual size: 47KB

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 47KB - Virtual size: 47KB