6f2a9fa4dbcffa9f1e6dd97e34095e1b_JaffaCakes118

General

Target

6f2a9fa4dbcffa9f1e6dd97e34095e1b_JaffaCakes118
Size

115KB
MD5

6f2a9fa4dbcffa9f1e6dd97e34095e1b
SHA1

ed02ca81bc22b5286b188e48ec8f586a7f8f7c20
SHA256

636b3a40866a4d4663913e87d08dac5b2ab960571eac61c6459c017a1cf21b64
SHA512

293bced33dc9c6d50d90e3648c13400df10ce7cf9f7a2c134029962e8fc85e0761eceb807752e61d9ac5be7bde7a4dcc0dfe64c761c56c9037d14407b8c313b6
SSDEEP

1536:bXaNSQyHUIWUUAGyqXaon6SllIA6wGDiVGgIxxvGq5BkUXQtnGkr96jbddYai+en:beIWXn6SxOvGq5AJ4B1DVD12

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6f2a9fa4dbcffa9f1e6dd97e34095e1b_JaffaCakes118

Files

6f2a9fa4dbcffa9f1e6dd97e34095e1b_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e3f7a5aa26913292de1c4b5db2455aed

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlFreeUnicodeString
RtlInitUnicodeString
_chkstk

kernel32

GetModuleFileNameA
lstrcpyA
CloseHandle
VirtualQuery
GetCurrentProcess
Sleep
SetLastError
GetProcAddress
LoadLibraryA
GetModuleHandleA
VirtualProtect
ExitProcess
CreateFileA
GetFileSize
lstrlenA
MoveFileExA
WaitForSingleObject
GetTickCount
VirtualFree
GetProcessHeap
WriteFile
TerminateProcess
ReadFile
lstrcatA
MultiByteToWideChar
SetThreadPriority
GetShortPathNameA
CreateDirectoryA
GetLastError
lstrcmpiA
VirtualAlloc
LocalAlloc
GetSystemInfo
WinExec
lstrcmpiW
CreateMutexA
GetVersionExA

shlwapi

StrDupA

user32

CreateDialogParamA
GetMessageA
EndPaint
MessageBoxA
LoadCursorA
FindWindowA
UpdateWindow
SetWindowTextA
GetSystemMetrics
DispatchMessageA
ShowWindow
DefWindowProcA
CreateWindowExA
TranslateMessage
BeginPaint
RegisterWindowMessageA
SendMessageA
SetFocus
CharUpperA
LoadIconA
GetTopWindow
GetClassInfoExA
PostQuitMessage
RegisterClassExA

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 102KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e3f7a5aa26913292de1c4b5db2455aed

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

shlwapi

user32

Sections

.text Size: 12KB - Virtual size: 11KB

.data Size: 102KB - Virtual size: 106KB

.rsrc Size: 512B - Virtual size: 16B

.text
Size: 12KB - Virtual size: 11KB

.data
Size: 102KB - Virtual size: 106KB

.rsrc
Size: 512B - Virtual size: 16B