43cba79a199c715d9d5f00c03a780dd5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

43cba79a199c715d9d5f00c03a780dd5_JaffaCakes118
Size

129KB
MD5

43cba79a199c715d9d5f00c03a780dd5
SHA1

3837b94c5f3d61330589adc8f0816a303194d593
SHA256

2d90e6e98a9f57675715b60b1271381c2fc39d5100e32d1e0352c93a2ba4db03
SHA512

c8712b69b9fcb01bf3077fef8736967432a7b8974dd9bead52a1612d3ff64624a68dd7e4f7aa92bf6bc0c72885f57ba4a582a6fb2b4ddff669c96ee59cf081b1
SSDEEP

1536:ssuX+f6R0V7SKuKzqncpD1Upbko2+GnK1FQI6nsNp/c5/rcUIZNS:ssU+f6R0dph+l2+6zIjNpE5/rcUIbS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
43cba79a199c715d9d5f00c03a780dd5_JaffaCakes118

Files

43cba79a199c715d9d5f00c03a780dd5_JaffaCakes118
.exe windows:5 windows x86 arch:x86

eb5adc1b9302dc7cd64607fd6a1bf87d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Lucas\Documents\Visual Studio 2010\Projects\Registry Test - Copy\Debug\Registry Test.pdb

Imports

kernel32

Sleep
ExitProcess
IsDebuggerPresent
FreeLibrary
GetProcAddress
LoadLibraryA
CloseHandle
WaitForSingleObject
EnumSystemLocalesA
GetLocaleInfoA
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetFileType
GetLastError
CreateFileA
CreateFileW
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
EncodePointer
DecodePointer
TerminateProcess
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
RtlUnwind
RaiseException
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
LoadLibraryW
IsProcessorFeaturePresent
GetModuleHandleW
WriteFile
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetStdHandle
GetConsoleCP
GetConsoleMode
SetFilePointer
SetEndOfFile
HeapAlloc
GetProcessHeap
ReadFile
InterlockedExchange
FlushFileBuffers
FatalAppExitA
VirtualQuery
SetConsoleCtrlHandler
GetLocaleInfoW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WriteConsoleW
HeapReAlloc
HeapSize
LCMapStringW
GetStringTypeW
GetUserDefaultLCID
IsValidLocale

wininet

InternetCheckConnectionA

Sections

.textbss
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eb5adc1b9302dc7cd64607fd6a1bf87d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

wininet

Sections

.textbss Size: - Virtual size: 64KB

.text Size: 94KB - Virtual size: 93KB

.rdata Size: 21KB - Virtual size: 20KB

.data Size: 5KB - Virtual size: 16KB

.idata Size: 3KB - Virtual size: 2KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 4KB - Virtual size: 4KB

.textbss
Size: - Virtual size: 64KB

.text
Size: 94KB - Virtual size: 93KB

.rdata
Size: 21KB - Virtual size: 20KB

.data
Size: 5KB - Virtual size: 16KB

.idata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 4KB - Virtual size: 4KB