6456645a2c17b4a02975a06d985b0ec6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6456645a2c17b4a02975a06d985b0ec6_JaffaCakes118
Size

1.2MB
MD5

6456645a2c17b4a02975a06d985b0ec6
SHA1

ccc548c95b3a9f7e30753f35aa09c56b16c483b0
SHA256

10cfac39199935e728f32cf2fcda9b3212cbc4763219e670e34086f03b57bad9
SHA512

d99c9039d491c1442f53a275ab8514a78b501d7f1ade0e6d2118f3f9fedb80d0c2706f4e662f4d9b9616707fece206ae99784706e5e884d71daa659e2295805a
SSDEEP

24576:igsicIlxgn+h+E1o/8Rb2ITixymkVKyzp7KJWs5R+IYttFUj:igGgUhF/8Rb2ITixsgyV7Ffu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6456645a2c17b4a02975a06d985b0ec6_JaffaCakes118

Files

6456645a2c17b4a02975a06d985b0ec6_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6b21d58bd6eb96a8264f1bda738f2653

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Builds\13810\Tools\FindLinks_master\bin\Win32\Release\FindLinks.pdb

Imports

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

kernel32

InterlockedDecrement
GetCurrentProcess
FormatMessageW
GetFileAttributesW
CreateFileW
GetLastError
GetCurrentDirectoryW
FindClose
FindNextFileW
CloseHandle
FindFirstFileW
HeapSize
WriteConsoleW
SetFilePointerEx
HeapReAlloc
OutputDebugStringW
RtlUnwind
GetFullPathNameW
LocalFree
LocalAlloc
GetProcAddress
GetStdHandle
GetModuleHandleW
LoadLibraryW
GetFileType
GetCommandLineW
GetModuleFileNameW
GetFileInformationByHandle
DecodePointer
GetStringTypeW
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
SetStdHandle
HeapFree
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
EncodePointer
FreeEnvironmentStringsW
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThreadId
WriteFile
GetProcessHeap
DeleteCriticalSection
ReadFile
FlushFileBuffers
GetConsoleCP
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RaiseException
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
LCMapStringW

user32

SetCursor
DialogBoxIndirectParamW
LoadCursorW
InflateRect
GetDlgItem
EndDialog
GetSysColorBrush
SendMessageW
SetWindowTextW

gdi32

StartPage
GetDeviceCaps
SetMapMode
StartDocW
EndDoc
EndPage

comdlg32

PrintDlgW

advapi32

RegCloseKey
RegOpenKeyW
RegQueryValueExW
RegCreateKeyW
RegSetValueExW

oleaut32

SysFreeString
SysAllocString

Sections

.text
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text0
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6b21d58bd6eb96a8264f1bda738f2653

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

kernel32

user32

gdi32

comdlg32

advapi32

oleaut32

Sections

.text Size: 70KB - Virtual size: 70KB

.rdata Size: 50KB - Virtual size: 49KB

.data Size: 5KB - Virtual size: 12KB

.rsrc Size: 1KB - Virtual size: 1KB

.text0 Size: 1.0MB - Virtual size: 1.0MB

.text
Size: 70KB - Virtual size: 70KB

.rdata
Size: 50KB - Virtual size: 49KB

.data
Size: 5KB - Virtual size: 12KB

.rsrc
Size: 1KB - Virtual size: 1KB

.text0
Size: 1.0MB - Virtual size: 1.0MB