4b7cc736e85f6c2d128a78c69280f12c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4b7cc736e85f6c2d128a78c69280f12c_JaffaCakes118
Size

291KB
MD5

4b7cc736e85f6c2d128a78c69280f12c
SHA1

1e5226e1581fc95416990b4ff35692476d1e53ac
SHA256

ad4b4bccc23b312f62461e80250c82afd1fe3a0910fcfc94f197d2803bd1c30b
SHA512

40c45f8670d7b4c7d8ea82fdaa0f56f31fecdeecd234bc6cd0f37e6f192bfd240da3add627c97a33a0ee215cd8e447f2829e4e99adccd1d70795d9afd497fdc1
SSDEEP

3072:8rqImm3GWadxec5WSvf8LzOeOXOOIDHkoA90duTmLiOAQ3zGJK7xFEgX96gOS+j9:8rVaLwS8Lkxo1duTO/FNXxIgePS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4b7cc736e85f6c2d128a78c69280f12c_JaffaCakes118

Files

4b7cc736e85f6c2d128a78c69280f12c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

ba4e8639c5e5c5f78587f4e2adc8c244

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\john\Desktop\cpl\Release\pemod.pdb

Imports

kernel32

HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetEnvironmentVariableW
GetProcessHeap
lstrlenW
lstrcatW
lstrcpyW
CreateDirectoryW
CopyFileW
CreateMutexW
FindResourceW
Sleep
LoadResource
LockResource
SizeofResource
ExitProcess
VirtualProtect
FreeResource
GetTempPathW
CreateFileW
WriteFile
CloseHandle
GetStringTypeW
LCMapStringW
FlushFileBuffers
WriteConsoleW
SetStdHandle
SetFilePointerEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetFileType
GetCurrentThreadId
GetCPInfo
GetOEMCP
lstrcmpiW
GetModuleFileNameW
DecodePointer
DeleteCriticalSection
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
GetLastError
OutputDebugStringW
RaiseException
GetACP
IsValidCodePage
LoadLibraryExW
GetStdHandle
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
EncodePointer
GetSystemTimeAsFileTime
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
IsProcessorFeaturePresent
RtlUnwind
GetConsoleCP
GetConsoleMode
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW

user32

LoadStringW
MessageBoxW
EndDialog
SendMessageW
PostQuitMessage
EndPaint
BeginPaint
DefWindowProcW
DestroyWindow
DialogBoxParamW
UpdateWindow
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
LoadImageW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW

gdi32

Ellipse
SelectObject
CreateSolidBrush
DeleteObject

advapi32

RegSetValueExW
RegCloseKey
RegCreateKeyW

shell32

ShellExecuteW
SHGetSpecialFolderPathW

ole32

CoInitialize
CoUninitialize
CoCreateInstance

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 197KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ba4e8639c5e5c5f78587f4e2adc8c244

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

Sections

.text Size: 61KB - Virtual size: 61KB

.rdata Size: 22KB - Virtual size: 22KB

.data Size: 5KB - Virtual size: 12KB

.rsrc Size: 197KB - Virtual size: 200KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 61KB - Virtual size: 61KB

.rdata
Size: 22KB - Virtual size: 22KB

.data
Size: 5KB - Virtual size: 12KB

.rsrc
Size: 197KB - Virtual size: 200KB

.reloc
Size: 4KB - Virtual size: 4KB