4011d9a32b57b7ecf3f183100e458e20_JaffaCakes118

General

Target

4011d9a32b57b7ecf3f183100e458e20_JaffaCakes118
Size

923KB
MD5

4011d9a32b57b7ecf3f183100e458e20
SHA1

f88c284ff15abec48fd8078627c2898f2fca29b3
SHA256

b653d529952703911288bb9255f6460418347535a33def3523069cd3ada53d7f
SHA512

cbf0641fe1bceee61e574f554560947d27f803f2c177c837fb8815c36e47c3a15771d8a42ca10e2d5b29ba3d9f0d142e9c9dfde5dc56b73a6af6094aab0688c2
SSDEEP

24576:UXqSX75lmCmvKjeEcnazZFo9l85BhN0TuDXxSkN0yuWN:UaKlm7SjeYVW+hNMuDp6yuWN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4011d9a32b57b7ecf3f183100e458e20_JaffaCakes118

Files

4011d9a32b57b7ecf3f183100e458e20_JaffaCakes118
.exe windows:5 windows x86 arch:x86

23490f0288af9e04191b3a6802c82643

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
WriteFile
CreateFileA
LockResource
SizeofResource
LoadResource
FindResourceA
CreateProcessA
GetTempFileNameA
GetTempPathA
WinExec
GetModuleFileNameA
Sleep
GetCommandLineA
GetModuleHandleA
HeapAlloc
GetStartupInfoA
GetProcAddress
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapFree
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
GetModuleHandleW
ExitProcess
GetStdHandle
GetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetFileType
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
LoadLibraryA
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSize
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
SetEndOfFile
GetProcessHeap
ReadFile

shell32

ShellExecuteA

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 832KB - Virtual size: 832KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

23490f0288af9e04191b3a6802c82643

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shell32

Sections

.text Size: 68KB - Virtual size: 67KB

.rdata Size: 16KB - Virtual size: 16KB

.data Size: 5KB - Virtual size: 12KB

.rsrc Size: 832KB - Virtual size: 832KB

.text
Size: 68KB - Virtual size: 67KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 5KB - Virtual size: 12KB

.rsrc
Size: 832KB - Virtual size: 832KB