70435c9f6ca4eb5f64e873318ac19035_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

70435c9f6ca4eb5f64e873318ac19035_JaffaCakes118
Size

164KB
MD5

70435c9f6ca4eb5f64e873318ac19035
SHA1

0ffb5cd52c9150b92e0a2981e7d07b33e73b117d
SHA256

0fc682d2bc14e3533719c280e7060dfcfa54a779607cd816f5ac374dd1851860
SHA512

304c378919e3f9908542e96a3f8b01f2569c280b5a833693c292a44b00ee732e3bae80885157c3ef7ef377a9a1814bf508ff4b7c9be5c1a8769f5ef1326862f1
SSDEEP

3072:SOPlRQNsmfrDPoN67Ze207iQxobyn+KjKuDAZW1nfy87D6kOaRgRs:5RQtfvPoNpubsjKSAwZ68/rfKR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
70435c9f6ca4eb5f64e873318ac19035_JaffaCakes118

Files

70435c9f6ca4eb5f64e873318ac19035_JaffaCakes118
.exe windows:5 windows x86 arch:x86

66a9d7f076cccea872d8d6b47b9d9915

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
GetEnvironmentStrings
GetVersionExA
GetCurrentProcessId
GetCommandLineW
GetEnvironmentStringsW
GetCommandLineA
GetModuleHandleA
GetCurrentThread
GetStdHandle
GetPriorityClass
GetOEMCP
GetACP
CompareStringW
CompareStringA
GetLocaleInfoW
VirtualAlloc
IsDebuggerPresent
GetTimeZoneInformation
GetUserDefaultLCID
GetStartupInfoW
GetVersion
ExitProcess
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
FreeEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
HeapAlloc
HeapReAlloc
IsBadWritePtr
GetProcAddress
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
Sleep
WideCharToMultiByte
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetCPInfo
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
SetEnvironmentVariableA

user32

SetWindowTextA
LoadCursorA
LoadIconA
LoadCursorFromFileA

crypt32

CryptMsgUpdate

setupapi

SetupGetLineCountW

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 111KB - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

66a9d7f076cccea872d8d6b47b9d9915

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

crypt32

setupapi

Sections

.text Size: 45KB - Virtual size: 44KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 111KB - Virtual size: 195KB

.rsrc Size: 1024B - Virtual size: 648B

.text
Size: 45KB - Virtual size: 44KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 111KB - Virtual size: 195KB

.rsrc
Size: 1024B - Virtual size: 648B