74c20b3c4214af50bc3e6dd2d9a6adfb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

74c20b3c4214af50bc3e6dd2d9a6adfb_JaffaCakes118
Size

47KB
MD5

74c20b3c4214af50bc3e6dd2d9a6adfb
SHA1

68d42e9d30439313ce3768ced60d6e11ea302ae8
SHA256

9d9fe77c9db3de343e0bd8bbf04fac1a1a155d6633594080ee4ea2b6d07ff6cc
SHA512

2b825e6720023fc50b43501576040e9810ccf63a62cdaf04a0e6150fcb25651e92c72e496d3940bc0f53106582840fb51f65551dca14fd7d573472158833d30f
SSDEEP

768:fgy5F2n4cMqG5Lzqg/oGHUv3SKm5qLCl2ZabQ39b+2LgDIu8tvhbq/:d244G5/7VMi3w0XbKbjBtFO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
74c20b3c4214af50bc3e6dd2d9a6adfb_JaffaCakes118

Files

74c20b3c4214af50bc3e6dd2d9a6adfb_JaffaCakes118
.exe windows:6 windows x86 arch:x86

b25fbced00f745a2b4be187173e83df9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

winrshost.pdb

Imports

advapi32

GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
TraceEvent

kernel32

GetProcessHeap
InterlockedIncrement
GetLastError
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
LocalFree
LocalAlloc
FreeLibrary
GetProcAddress
LoadLibraryW
GetVersionExW
SetConsoleCtrlHandler
DeleteCriticalSection
AllocConsole
InitializeCriticalSection
HeapSetInformation
InterlockedDecrement
CloseHandle
SetThreadPreferredUILanguages
SetConsoleCP
SetConsoleOutputCP
CreateProcessW
GenerateConsoleCtrlEvent
WriteConsoleInputW
SetConsoleMode
GetConsoleMode
GetStdHandle
OpenProcess
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange

user32

TranslateMessage
GetMessageW
PostMessageW
DefWindowProcW
DeleteMenu
GetSystemMenu
UpdateWindow
ShowWindow
CreateWindowExW
RegisterClassW
LoadIconW
UnregisterClassW
DestroyWindow
DispatchMessageW
LoadCursorW

msvcrt

_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
_unlock
__dllonexit
_lock
_initterm
?terminate@@YAXXZ
_except_handler4_common
_controlfp
memcpy
memset
__CxxFrameHandler3
_onexit
_wcsicmp
mbtowc
__getmainargs
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit

ole32

CoRegisterClassObject
CoInitializeEx
CoCreateInstance
CoUninitialize
CoRevokeClassObject
CoInitializeSecurity

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

faxkovi
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b25fbced00f745a2b4be187173e83df9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

ole32

Sections

.text Size: 15KB - Virtual size: 15KB

.data Size: 512B - Virtual size: 1024B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 28KB - Virtual size: 29KB

faxkovi Size: - Virtual size: 4KB

.text
Size: 15KB - Virtual size: 15KB

.data
Size: 512B - Virtual size: 1024B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 28KB - Virtual size: 29KB

faxkovi
Size: - Virtual size: 4KB