4c56302837ba8aa8412af86dd382b7d1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4c56302837ba8aa8412af86dd382b7d1_JaffaCakes118
Size

186KB
MD5

4c56302837ba8aa8412af86dd382b7d1
SHA1

e5389e316e8ca23f4b4561219b167f91ae0dffac
SHA256

2093a790d5b0b875ae8669a6a4024c350b663d2fdb79579c728eb916bb6e5410
SHA512

3c5bb9afd4e4e457310af8711bd40563f744a28c26fc7ad1468902ecd9b6bc9d7c577bac5315dd3ffae52920b22e7ac63a701edbe2c410b8373ba96ec3924416
SSDEEP

3072:mqJP8jgXJ/rcJE9HeMcXXE7ttshDqJf2kYFYyUP3/3:m+8joRcJE9+xnE7d3qi3v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c56302837ba8aa8412af86dd382b7d1_JaffaCakes118

Files

4c56302837ba8aa8412af86dd382b7d1_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6b4c952023f82cf552f4919442d54858

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

X:\starter\WinStarter2\Release\starter.pdb

Imports

kernel32

Sleep
GetExitCodeProcess
ReadFile
FindClose
CreatePipe
FindNextFileW
CloseHandle
DeleteFileW
CreateThread
WaitForSingleObject
SetCurrentDirectoryW
GetFileAttributesW
GetModuleFileNameW
SetHandleInformation
GetProcessHeap
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
GetStringTypeW
LCMapStringW
WriteConsoleW
FlushFileBuffers
SetStdHandle
LoadLibraryW
HeapReAlloc
CreateFileW
GetSystemTimeAsFileTime
PeekNamedPipe
CreateProcessW
FindFirstFileW
EncodePointer
DecodePointer
GetLastError
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
RtlUnwind
HeapSize
GetProcAddress
GetModuleHandleW
ExitProcess
MultiByteToWideChar
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
SetFilePointer
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId

user32

GetSystemMenu
GetWindowRect
EnableMenuItem
GetDesktopWindow
ShowWindow
MoveWindow
LoadCursorW
LoadIconW
RegisterClassW
PostMessageW
wsprintfW
MessageBoxW
GetMessageW
PostQuitMessage
CreateWindowExW
SendMessageW
UpdateWindow
DefWindowProcW
DispatchMessageW

gdi32

CreateFontW

comctl32

ord17

Sections

.text
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6b4c952023f82cf552f4919442d54858

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comctl32

Sections

.text Size: 88KB - Virtual size: 88KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 5KB - Virtual size: 12KB

.rsrc Size: 72KB - Virtual size: 71KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 88KB - Virtual size: 88KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 5KB - Virtual size: 12KB

.rsrc
Size: 72KB - Virtual size: 71KB

.reloc
Size: 7KB - Virtual size: 7KB