749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118

General

Target

749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118
Size

269KB
MD5

749d6e169b1b9eb0eccd872fb74cf5d1
SHA1

650c3400402853ac0e781909e20bb31001e79288
SHA256

b57d4e5ce347cd70089cb4ee66e7756330b6f65c870afaccebdc4cbf512e7e03
SHA512

d429f861834b157d9f42191434c4471782974291f701ed9326f460725249da9adb7793fbebd21eb01fd98de912d117b65ec87720b76fccb84e3a192adfd4eb8e
SSDEEP

6144:grEGCkgR0Qq97lDV0Os75EfbPFK5g3mBU5KXB7PDpqjP:uCBCQq5VZ9WgOyKXxPD07

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118

Files

749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118
.exe windows:5 windows x86 arch:x86

90423bc19366bebbbe8dacbfabc95efd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtResumeThread
NtWriteFile
ZwOpenEvent
NtQueryInformationThread
RtlCompareMemory
NtQuerySystemTime
ZwProtectVirtualMemory
ZwSetEvent
NtQuerySection
NtSuspendThread
RtlCompareString

kernel32

InterlockedDecrement
LoadResource
LoadLibraryW
GetCurrentDirectoryA
UnhandledExceptionFilter
SetFilePointer
FileTimeToSystemTime
GetSystemTimeAsFileTime
GetStringTypeW
GlobalLock
GlobalAlloc
GetUserDefaultLCID
GetCurrentThreadId
LockResource
LoadLibraryA
RaiseException
SetFileTime
GetACP
SetFileAttributesW
Sleep
MulDiv
GetLogicalDrives
Sleep
GlobalGetAtomNameA
RtlUnwind
lstrlenA
EnterCriticalSection
ResumeThread
GetOEMCP
ExitProcess
FlushFileBuffers
HeapSize
IsBadCodePtr
GetFileAttributesW
GetModuleFileNameA
GetThreadLocale
TlsAlloc
GetCurrentDirectoryW
LCMapStringA
FreeEnvironmentStringsW
GlobalGetAtomNameW
GetTickCount
SetPriorityClass
WaitForSingleObject
GetCommandLineA
GetSystemDefaultLangID
SizeofResource
GetDateFormatA
VirtualAlloc

Sections

.text
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

90423bc19366bebbbe8dacbfabc95efd

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

Sections

.text Size: 192KB - Virtual size: 192KB

.data Size: 70KB - Virtual size: 70KB

.rsrc Size: 5KB - Virtual size: 8KB

.text
Size: 192KB - Virtual size: 192KB

.data
Size: 70KB - Virtual size: 70KB

.rsrc
Size: 5KB - Virtual size: 8KB