5df31e5ab1f18abb6988c6a1baaf565b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5df31e5ab1f18abb6988c6a1baaf565b_JaffaCakes118
Size

196KB
MD5

5df31e5ab1f18abb6988c6a1baaf565b
SHA1

bfccd8779d64a4845c1a06735ed811d9753982e5
SHA256

f492a8b86bbd70975cd524c4ac45df283ea42c280a9423911405824d27a07942
SHA512

92a7b8e8a180785c789c8b6cc9c8e55024056cf4fdbd3c95926392572e1327074b1daa3d6952d995d6731be7e5a28b72a15732c54241765daa56b90e0b7f1834
SSDEEP

3072:PtGvZMe1mtNIobQwb5Iy2pEkhYZ4z1sxtbjIUWnoRzW:PtG2eovIowy2pGZ4zytbLi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5df31e5ab1f18abb6988c6a1baaf565b_JaffaCakes118

Files

5df31e5ab1f18abb6988c6a1baaf565b_JaffaCakes118
.exe windows:5 windows x64 arch:x64

d0ce41939822ef57d80fca3a6aac0f35

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\sandbox\muse\projects\YTBInstallWrapper\Trunk\builds\x64\Release\YTBInstallWrapper.pdb

Imports

kernel32

WaitForSingleObject
GetLastError
CreateProcessA
CloseHandle
GetExitCodeProcess
GetStartupInfoA
WideCharToMultiByte
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
RtlUnwindEx
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
HeapFree
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapAlloc
HeapReAlloc
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
CreateFileA
FlushFileBuffers

advapi32

RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegCloseKey

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 758B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d0ce41939822ef57d80fca3a6aac0f35

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

Sections

.text Size: 35KB - Virtual size: 35KB

.rdata Size: 10KB - Virtual size: 9KB

.data Size: 5KB - Virtual size: 13KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 49KB - Virtual size: 48KB

.reloc Size: 1024B - Virtual size: 758B

.text
Size: 35KB - Virtual size: 35KB

.rdata
Size: 10KB - Virtual size: 9KB

.data
Size: 5KB - Virtual size: 13KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 49KB - Virtual size: 48KB

.reloc
Size: 1024B - Virtual size: 758B