87e149385fb425169f124e176af2ddbf_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

87e149385fb425169f124e176af2ddbf_JaffaCakes118
Size

148KB
MD5

87e149385fb425169f124e176af2ddbf
SHA1

bbc647c5159c9fe561a77e51edeca590ae9669dd
SHA256

b0eb1d585df584a5c487d70e3028ee4a61754067a70821d1f5f5cad8f718b3d9
SHA512

28c655549414f76abff15079733bf6b2c5a9af8b484a11abc404a94fb0540fd16e6560381064e62da875d53c087379d698a9240a249078752dc5002c46fdb749
SSDEEP

3072:CLNbCIzZk2xFIq4x/tO3/er7Dvdgu6R9tdKQMto7y3CvM:IeH2xGqdWrP+RMntTCvM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
87e149385fb425169f124e176af2ddbf_JaffaCakes118

Files

87e149385fb425169f124e176af2ddbf_JaffaCakes118
.exe windows:4 windows x86 arch:x86

17b1c8d8bf80a676593be3fa7376a1ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Weje\Cyki\Oqijyva\Ohafow.pdb

Imports

kernel32

QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
SetEndOfFile
FindResourceA
LoadResource
SetTapePosition
VirtualAlloc
VirtualProtect
VirtualFree
ResetEvent
CreateDirectoryA
GlobalUnlock
QueryPerformanceFrequency
GlobalAlloc
GlobalFree
SetUnhandledExceptionFilter
GetModuleHandleA
GetCommandLineA
GetVersionExA
HeapFree
GetLastError
CloseHandle
WriteFile
ExitProcess
GetProcAddress
TerminateProcess
GetCurrentProcess
SetFilePointer
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
HeapReAlloc
IsBadWritePtr
SetStdHandle
FlushFileBuffers
CreateFileA
LoadLibraryA
RtlUnwind
InterlockedExchange
VirtualQuery
GetLocaleInfoA
GetSystemInfo
LCMapStringA
LCMapStringW
ReadFile

user32

LoadImageA
DrawIcon
DispatchMessageA
IsWindowEnabled
GetClassNameA
CheckMenuRadioItem

advapi32

SetSecurityDescriptorGroup
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
AllocateAndInitializeSid
FreeSid
OpenProcessToken
StartServiceCtrlDispatcherA
InitializeSecurityDescriptor
RegEnumKeyA
RegSetValueExA
RegisterServiceCtrlHandlerA
SetSecurityDescriptorDacl
SetServiceStatus
LookupPrivilegeValueA
OpenSCManagerA
OpenServiceA
OpenThreadToken
QueryServiceStatus
RegCreateKeyExA
RegDeleteKeyA
SetSecurityDescriptorOwner
RegOpenKeyA

Sections

.text
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

17b1c8d8bf80a676593be3fa7376a1ae

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

Sections

.text Size: 56KB - Virtual size: 53KB

.rdata Size: 32KB - Virtual size: 29KB

.data Size: 4KB - Virtual size: 316KB

.rsrc Size: 52KB - Virtual size: 50KB

.text
Size: 56KB - Virtual size: 53KB

.rdata
Size: 32KB - Virtual size: 29KB

.data
Size: 4KB - Virtual size: 316KB

.rsrc
Size: 52KB - Virtual size: 50KB