4e1748227662cd342429ea5e9d060416_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4e1748227662cd342429ea5e9d060416_JaffaCakes118
Size

220KB
MD5

4e1748227662cd342429ea5e9d060416
SHA1

20411aa4b400eb46269d8ef2930f337d9ab02548
SHA256

8f151d794e85f2bd27e90f089cc22b8965b57e7ed737f149514ca02bc937506d
SHA512

c959ddd2c75a93c992f85d83e7b309502c0041830898a9bc23fa936674077e08290020235bf73d535c4050688f401653ccf74c9b3486222de2e0c26332726757
SSDEEP

3072:qO2qdB7K9shIPFJRAhP2EAeJ3l/FK0JXAFdBrCt/2u6F1HHzrP0ZuhYM/WVHnNn7:qO2YB7KDDePNUa6dRC363hnWW9Xga7Xs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4e1748227662cd342429ea5e9d060416_JaffaCakes118

Files

4e1748227662cd342429ea5e9d060416_JaffaCakes118
.exe windows:6 windows x86 arch:x86

22300191c1c79f65815db76c38ca9037

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

WinMgmt.pdb

Imports

kernel32

LCMapStringW
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryExW
WriteFile
GetStdHandle
WideCharToMultiByte
GetConsoleOutputCP
GetCommandLineW
CloseHandle
CreateProcessW
RegisterApplicationRestart
GetCurrentProcessId
GetCommandLineA
GetModuleHandleW
SetThreadPreferredUILanguages
HeapSetInformation
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryExA
Sleep
InterlockedExchange
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter

msvcrt

_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
exit
_exit
__wgetmainargs
setlocale
strspn
mbstowcs
isspace
atoi
memset
__CxxFrameHandler3
_XcptFilter
_vsnwprintf
_vsnprintf
_cexit

wbemcomn

?GetWMIADAPCmdLine@@YGPAGH@Z
?GetMemLogObject@@YGPAVCMemoryLog@@XZ
?Write@CMemoryLog@@QAEXJ@Z
?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z
?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z
?EnablePrivilege@@YGHKJ@Z
?DebugTrace@@YAHDPBDZZ

ntdll

EtwTraceMessage

shell32

CommandLineToArgvW

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

PACK
Size: 144KB - Virtual size: 380KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

22300191c1c79f65815db76c38ca9037

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcrt

wbemcomn

ntdll

shell32

Sections

.text Size: 10KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 13KB

.rsrc Size: 63KB - Virtual size: 62KB

.reloc Size: 1KB - Virtual size: 1KB

PACK Size: 144KB - Virtual size: 380KB

.text
Size: 10KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 13KB

.rsrc
Size: 63KB - Virtual size: 62KB

.reloc
Size: 1KB - Virtual size: 1KB

PACK
Size: 144KB - Virtual size: 380KB