76ecb8f6c617c27dde7b5ca462841faf_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

76ecb8f6c617c27dde7b5ca462841faf_JaffaCakes118
Size

268KB
MD5

76ecb8f6c617c27dde7b5ca462841faf
SHA1

5cc150c6cfa428298c02854838499d21ef27d71c
SHA256

69259195ecffeff1ff80351790d50476f0e9d4a2e2a33bc13003c70568786d54
SHA512

070e38dcd04d7882318fab7922d9de59ee98a151cec8e7a7f5fc10f28352ff85ef1b564960a5841c4fb15330b3045b1c885bcb1d0ee483fbef30395bd9e9a47f
SSDEEP

6144:sZhwBrnkQsbJmzLVy0J6eYhpgV97vPyuNXq:iLpszLVgeYhpgv7vPyM6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
76ecb8f6c617c27dde7b5ca462841faf_JaffaCakes118

Files

76ecb8f6c617c27dde7b5ca462841faf_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6b682ab991cdc28610945d01443f820f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsDebuggerPresent
GetLastError
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
CreateEventW
lstrlenW
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
GetModuleFileNameW
WaitForMultipleObjects
SetEvent
MulDiv
GetModuleHandleW
WaitForSingleObject
LoadLibraryW
FreeLibrary
lstrcpynW
GetVersionExW
lstrcmpW
GetProcAddress
LoadLibraryA

user32

LoadIconW
GetFocus
SetCursor
CopyRect
GetIconInfo
DestroyIcon
IsWindow
GetSysColor
InvalidateRect
GetSystemMetrics
EnableWindow
LoadImageW
IsIconic
PostMessageW
SendMessageW
LoadCursorW

gdi32

GetStockObject
DeleteObject
CreatePen
CreateFontIndirectW
CreatePatternBrush
CreatePalette
CreateRectRgn
CreateCompatibleDC
CreateSolidBrush

comctl32

ord17

query

CIState
DllCanUnloadNow
BeginCacheTransaction
CiSvcMain
InitializeCIISAPIPerformanceData

mscat32

CryptCATEnumerateAttr
CryptCATAdminReleaseContext
MsCatConstructHashTag
CryptCATStoreFromHandle
CryptCATGetCatAttrInfo

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 1KB - Virtual size: 273KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 2KB - Virtual size: 432KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 86KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 133KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6b682ab991cdc28610945d01443f820f

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comctl32

query

mscat32

Sections

.text Size: 9KB - Virtual size: 9KB

.text Size: 16KB - Virtual size: 16KB

.edata Size: 1KB - Virtual size: 273KB

.rdata Size: 2KB - Virtual size: 35KB

.edata Size: 2KB - Virtual size: 432KB

.edata Size: 86KB - Virtual size: 121KB

.data Size: 6KB - Virtual size: 363KB

.edata Size: 133KB - Virtual size: 150KB

.rsrc Size: 10KB - Virtual size: 10KB

.text
Size: 9KB - Virtual size: 9KB

.text
Size: 16KB - Virtual size: 16KB

.edata
Size: 1KB - Virtual size: 273KB

.rdata
Size: 2KB - Virtual size: 35KB

.edata
Size: 2KB - Virtual size: 432KB

.edata
Size: 86KB - Virtual size: 121KB

.data
Size: 6KB - Virtual size: 363KB

.edata
Size: 133KB - Virtual size: 150KB

.rsrc
Size: 10KB - Virtual size: 10KB