829416502612dafe84cb071e11bfe6a6_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

829416502612dafe84cb071e11bfe6a6_JaffaCakes118
Size

327KB
MD5

829416502612dafe84cb071e11bfe6a6
SHA1

c7c863e9a936c2b1b2d57e04d157e94aa51ca934
SHA256

baa3f0bbeab44c83f164f1896ebdcf5bbd930d0ff29b915b005df961817031e1
SHA512

c1a492c21bff3aebb09f3166a7dd983a96cf2c492c543c080581840888ddfddf3822096b3bed0c605a697f3a0144afa9e9572738a424514d3732db1703997753
SSDEEP

6144:jJS+mEIpdnxcOn8zjqwzx3byDEEAr5Mg5z9xh/ZZLfgChB9:kjphxgpmoPr5Mg5z9xBZZzgyB9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
829416502612dafe84cb071e11bfe6a6_JaffaCakes118

Files

829416502612dafe84cb071e11bfe6a6_JaffaCakes118
.exe windows:5 windows x86 arch:x86

4128c9451a36c64f2d09757cd7123731

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

LdrGetProcedureAddress
_CIsqrt
_CIsin
_CIcos
memset
memcpy
_chkstk
LdrLoadDll
RtlInitAnsiString
RtlInitUnicodeString

kernel32

GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
GetCurrentProcessId
MulDiv
GetTickCount
ExitProcess
GetCurrentProcess
GetSystemTimeAsFileTime
CreateThread
WaitForSingleObject
Sleep

user32

SetRect
OffsetRect
EndDialog
PostQuitMessage
DefWindowProcW
DestroyWindow
DialogBoxParamW
UpdateWindow
ShowWindow
CreateWindowExW
RegisterClassExW
LoadCursorW
LoadIconW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
LoadStringW
ReleaseDC
GetDC

gdi32

GetTextExtentExPointW
DeleteObject
SelectObject
CreateFontW
GetDeviceCaps
SetDIBitsToDevice
GetGlyphOutlineW

msvcr90

??_U@YAPAXI@Z
realloc
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
_CIatan
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_time64
srand
??2@YAPAXI@Z
rand
fwrite
fclose
fread
malloc
free
??3@YAXPAX@Z
__CxxFrameHandler3
_CItan
_wfopen
__wgetmainargs

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?uncaught_exception@std@@YA_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

Sections

.text
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 245KB - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4128c9451a36c64f2d09757cd7123731

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

user32

gdi32

msvcr90

msvcp90

Sections

.text Size: 73KB - Virtual size: 73KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 3KB

.rsrc Size: 245KB - Virtual size: 244KB

.text
Size: 73KB - Virtual size: 73KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 245KB - Virtual size: 244KB