86524d4c8dc9fdbc285a4d096f75bdfe_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

86524d4c8dc9fdbc285a4d096f75bdfe_JaffaCakes118
Size

130KB
MD5

86524d4c8dc9fdbc285a4d096f75bdfe
SHA1

b700feef809c3dffc0162903f61e196fa6b4c2da
SHA256

40139637f91291406ef74bedbc9ee32dafd94b3f61e2486333a10818e8174f1a
SHA512

2c8729b3aa07d43d70f5c00e822dd1b0aaf5e7cddc49de918d7093683460eeee05f2529bedc70e94aa404ebeb84eed36c5cc23e6e8c0f65f6e4b84c410cd67d3
SSDEEP

3072:l1rjTo6A6xb+OaUDoW01431RiPQrTRATp0LJf:lJsfkbC1ortATp+Jf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
86524d4c8dc9fdbc285a4d096f75bdfe_JaffaCakes118

Files

86524d4c8dc9fdbc285a4d096f75bdfe_JaffaCakes118
.exe windows:4 windows x86 arch:x86

79e50cb402ca7e0da354b4643e5caf31

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsnmp32

ord301
ord320
ord105
ord402
ord302
ord107
ord220
ord203
ord204
ord501
ord504
ord222
ord500
ord300
ord999
ord201
ord205
ord900

kernel32

FileTimeToDosDateTime
UnlockFile
AddAtomW
ReadProcessMemory
GetPriorityClass
Module32Next
SetThreadAffinityMask
CreateDirectoryA
GetCommandLineW
VirtualAlloc
ExitProcess
GetConsoleCP
GetOEMCP
GetCommandLineA
CreateNamedPipeW
VirtualFree
GetTickCount
GetTempPathA

untfs

??0NTFS_BITMAP@@QAE@XZ
?IsAttributePresent@NTFS_FILE_RECORD_SEGMENT@@QAEEKPBVWSTRING@@E@Z
?Write@NTFS_BITMAP@@QAEEPAVNTFS_ATTRIBUTE@@PAV1@@Z
??0NTFS_LOG_FILE@@QAE@XZ
?InsertEntry@NTFS_INDEX_TREE@@QAEEKPAXU_MFT_SEGMENT_REFERENCE@@E@Z
?Initialize@NTFS_LOG_FILE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
??0NTFS_FILE_RECORD_SEGMENT@@QAE@XZ
?IsFree@NTFS_BITMAP@@QBEEVBIG_INT@@0@Z
?Initialize@NTFS_MFT_FILE@@QAEEPAVLOG_IO_DP_DRIVE@@VBIG_INT@@KK1PAVNTFS_BITMAP@@PAVNTFS_UPCASE_TABLE@@@Z
?Initialize@NTFS_EXTENT_LIST@@QAEEVBIG_INT@@0@Z
?Create@NTFS_FILE_RECORD_SEGMENT@@QAEEPBU_STANDARD_INFORMATION@@G@Z
?Initialize@NTFS_BITMAP@@QAEEVBIG_INT@@EPAVLOG_IO_DP_DRIVE@@K@Z
?Read@NTFS_FRS_STRUCTURE@@UAEEXZ
??1NTFS_LOG_FILE@@UAE@XZ
?Flush@NTFS_MFT_FILE@@QAEEXZ
?Flush@NTFS_FILE_RECORD_SEGMENT@@QAEEPAVNTFS_BITMAP@@PAVNTFS_INDEX_TREE@@E@Z
??1NTFS_UPCASE_FILE@@UAE@XZ

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.CRT
Size: 5KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 2.9MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 7KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

79e50cb402ca7e0da354b4643e5caf31

Headers

File Characteristics

Imports

wsnmp32

kernel32

untfs

Sections

.text Size: 12KB - Virtual size: 12KB

.CRT Size: 5KB - Virtual size: 1.2MB

DATA Size: 2.9MB - Virtual size: 4.7MB

.tls Size: - Virtual size: 7KB

.data Size: 512B - Virtual size: 24B

.rsrc Size: 36KB - Virtual size: 36KB

.text
Size: 12KB - Virtual size: 12KB

.CRT
Size: 5KB - Virtual size: 1.2MB

DATA
Size: 2.9MB - Virtual size: 4.7MB

.tls
Size: - Virtual size: 7KB

.data
Size: 512B - Virtual size: 24B

.rsrc
Size: 36KB - Virtual size: 36KB