5c87e28852513d33e46df19bb8536f62_JaffaCakes118

General

Target

5c87e28852513d33e46df19bb8536f62_JaffaCakes118
Size

295KB
MD5

5c87e28852513d33e46df19bb8536f62
SHA1

dc63d448487278961de16895fc8d7fc3dd19ba01
SHA256

2f835f0127b176cc52e3373b0bad1fa140b74448d8c81ced851162b143d03eb7
SHA512

95acc89892f110081e7d9f38d090382f930cf9a2b967d6da2347398439660a1a04c500aa91666d3683d2e2d264f0050203cc39646e08a92ae6c5c979fb1c7fdb
SSDEEP

3072:LhmUfCUphjBzq2LAVIY8UTd1CqVod5+XT7ejc82uJAbVYJVfNWhGkWFObXs51S8w:9tBc2WOhNhFn9GC+u+dlKeGkcsz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5c87e28852513d33e46df19bb8536f62_JaffaCakes118

Files

5c87e28852513d33e46df19bb8536f62_JaffaCakes118
.exe windows:5 windows x86 arch:x86

480940f32f94009f733d9dce2487d38a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

python32

Py_NoSiteFlag
Py_FrozenFlag
Py_IgnoreEnvironmentFlag
PyImport_FrozenModules
Py_SetPythonHome
PyMem_Malloc
Py_SetProgramName
Py_GetProgramFullPath
Py_Initialize
PySys_SetArgv
Py_Finalize
PyDict_New
PyEval_EvalCode
PyEval_GetBuiltins
PyDict_SetItemString
PyImport_ImportModule
PyObject_CallMethod
PyErr_Clear
PySys_GetObject
PyList_Insert
PyUnicodeUCS2_Decode
Py_FileSystemDefaultEncoding
PyUnicodeUCS2_AsEncodedString
PyErr_Print
Py_FatalError

msvcr90

_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
wcstombs
mbstowcs
setlocale
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
exit
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer

kernel32

IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
InterlockedCompareExchange
Sleep
InterlockedExchange

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

480940f32f94009f733d9dce2487d38a

Headers

DLL Characteristics

File Characteristics

Imports

python32

msvcr90

kernel32

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 1.2MB - Virtual size: 1.2MB

.rsrc Size: 1024B - Virtual size: 688B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1.2MB - Virtual size: 1.2MB

.rsrc
Size: 1024B - Virtual size: 688B