4aabc97ac6688b0c3faa928e844162f4_JaffaCakes118

General

Target

4aabc97ac6688b0c3faa928e844162f4_JaffaCakes118
Size

447KB
MD5

4aabc97ac6688b0c3faa928e844162f4
SHA1

fe3b133cf9b3014c0b207846219935a40a1f8044
SHA256

36873761808068dc42f6f2b682c7851c94dda1eea9b0205a0cbfcb0100a43551
SHA512

d4e92d069bed7d1f1645af3108cc8a0ccca1dce00ea36e5a57b32e5edc4af1a405d171d499b6ed1fb5e88a2b7b6972f35dd740013b0755b73638e35edc1592f1
SSDEEP

12288:9yqMrdB/4hUm54NEuIAiks8B3yMdG0KXLuxDvcEi0/3IWVz/McDeA:9yqMrdB/4Oiks85y2/r

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4aabc97ac6688b0c3faa928e844162f4_JaffaCakes118

Files

4aabc97ac6688b0c3faa928e844162f4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1b445c3eabcf6728ec3795d64a7599d7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegOpenKeyExA
RegSetValueExA

kernel32

AddAtomA
CopyFileA
CreateSemaphoreA
ExitProcess
FindAtomA
GetAtomNameA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetWindowsDirectoryA
InterlockedDecrement
InterlockedIncrement
ReleaseSemaphore
SetLastError
SetUnhandledExceptionFilter
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForSingleObject

msvcrt

_fdopen
_read
_strdup
_write
__getmainargs
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_ctype
_errno
_fstati64
_iob
_isctype
_lseeki64
_onexit
_pctype
_setmode
_strnicmp
_vsnprintf
abort
atexit
fclose
fflush
fopen
fprintf
free
localeconv
malloc
memchr
memcpy
memmove
memset
setlocale
setvbuf
signal
strcat
strcmp
strcoll
strcpy
strftime
strlen
strtod
strxfrm

user32

GetAsyncKeyState

Sections

.text
Size: 237KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1b445c3eabcf6728ec3795d64a7599d7

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

user32

Sections

.text Size: 237KB - Virtual size: 236KB

.data Size: 512B - Virtual size: 384B

.rdata Size: 9KB - Virtual size: 9KB

.bss Size: - Virtual size: 17KB

.idata Size: 2KB - Virtual size: 2KB

.text
Size: 237KB - Virtual size: 236KB

.data
Size: 512B - Virtual size: 384B

.rdata
Size: 9KB - Virtual size: 9KB

.bss
Size: - Virtual size: 17KB

.idata
Size: 2KB - Virtual size: 2KB