3e65452873d9d09bbd4794c633972f12_JaffaCakes118

General

Target

3e65452873d9d09bbd4794c633972f12_JaffaCakes118
Size

161KB
MD5

3e65452873d9d09bbd4794c633972f12
SHA1

ddfcf825f4691702645dab77b32f223049f4c428
SHA256

c97ecae2bfa1ad41ff9dc66446474049c97fb16c9bd6bee179ffec6c5b9829ab
SHA512

7552aff0c15c97b29dd7895e4b0d4c318e99957e127dafd2413a073332d6a2d7282506d2fe3e84abb770ad385f5e2093e2575c56eede0c028aadd6adc67cb985
SSDEEP

3072:s0Tm0uv4chWaXqEFoPLwjDRIXwwM1/Yif9qIkxltjEK/glf6bu:s0i0uv4kzD0wJAif7kNb/glf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e65452873d9d09bbd4794c633972f12_JaffaCakes118

Files

3e65452873d9d09bbd4794c633972f12_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6f39f8da106b6d4b5073ef3ee4f5d0ba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

QueryPerformanceCounter
CreateFileA
GetWindowsDirectoryA
GetSystemTime
OpenProcess
GetVersionExA
GetModuleHandleA
GetDateFormatA
FindResourceA
CreateProcessA
GetFileAttributesA
WriteConsoleW
VirtualProtect
LocalAlloc
GetProcAddress
FreeLibrary
InterlockedExchange
GetLastError
LoadLibraryA
RaiseException
HeapFree
HeapAlloc
GetCommandLineA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
CloseHandle
ExitProcess
TerminateProcess
GetCurrentProcess
SetFilePointer
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
SetStdHandle
FlushFileBuffers
GetACP
GetOEMCP
GetCPInfo
RtlUnwind
VirtualQuery
HeapSize
SetEndOfFile
ReadFile
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetSystemInfo

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 318KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6f39f8da106b6d4b5073ef3ee4f5d0ba

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 76KB - Virtual size: 72KB

.data Size: 36KB - Virtual size: 318KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 76KB - Virtual size: 72KB

.data
Size: 36KB - Virtual size: 318KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 4KB