767d89158ca3d3650da6c6f96b4d7291_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

767d89158ca3d3650da6c6f96b4d7291_JaffaCakes118
Size

86KB
MD5

767d89158ca3d3650da6c6f96b4d7291
SHA1

29c6482bb2342a5cc1217071ebca481656ae3219
SHA256

ffa08ee748b3a5e2fa4a5806e689a3d1faf1a8ad4d4821d24384c0c683576e12
SHA512

bec56a57aa38a1840a9abfac0e3ce6ee995489d6e6250f1aa07487a3801edf02e2992f5648d73d85cdeca5b3923671cfb9cc38f7880db0ef48e3ba220625f4b6
SSDEEP

384:WAfwuxMEyIht6Pq6NdanOyhm9PXwUbPKqNJVABZg1xq3UZU9a1xq3UZU9kpzN:TYu8egNdRyhm9oUXHABZaZU9QZU9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
767d89158ca3d3650da6c6f96b4d7291_JaffaCakes118

Files

767d89158ca3d3650da6c6f96b4d7291_JaffaCakes118
.exe windows:5 windows x86 arch:x86

3d4d5f35d3ebcff772e8ac4dcfd7963d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\documents and settings\skno\my documents\visual studio 2010\Projects\s1\Debug\s1.pdb

Imports

user32

EndDialog
DialogBoxParamW
DestroyWindow
DefWindowProcW
BeginPaint
EndPaint
PostQuitMessage
CreateWindowExW
ShowWindow
UpdateWindow
LoadIconW
LoadCursorW
RegisterClassExW
LoadStringW
LoadAcceleratorsW
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW

msvcr100d

_cexit
exit
_wcmdln
_CrtSetCheckCount
_CrtDbgReportW
_initterm
_initterm_e
_crt_debugger_hook
?terminate@@YAXXZ
_controlfp_s
_invoke_watson
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_XcptFilter
__wgetmainargs
_amsg_exit
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_CRT_RTC_INITW
_exit

kernel32

FreeLibrary
VirtualQuery
GetModuleFileNameW
GetProcessHeap
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DecodePointer
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LoadLibraryW
GetProcAddress
lstrlenA
MultiByteToWideChar
IsDebuggerPresent
WideCharToMultiByte
GetStartupInfoW
HeapSetInformation
InterlockedCompareExchange
Sleep
InterlockedExchange
RaiseException
EncodePointer

Sections

.textbss
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3d4d5f35d3ebcff772e8ac4dcfd7963d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

msvcr100d

kernel32

Sections

.textbss Size: - Virtual size: 64KB

.text Size: 15KB - Virtual size: 14KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 3KB - Virtual size: 2KB

.rsrc Size: 58KB - Virtual size: 57KB

.reloc Size: 1KB - Virtual size: 1KB

.textbss
Size: - Virtual size: 64KB

.text
Size: 15KB - Virtual size: 14KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 58KB - Virtual size: 57KB

.reloc
Size: 1KB - Virtual size: 1KB