87493e622eefbf8106cde3a8ce807c60_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

87493e622eefbf8106cde3a8ce807c60_JaffaCakes118
Size

432KB
MD5

87493e622eefbf8106cde3a8ce807c60
SHA1

8d7fb4c9246d992693795ddd09e360ea296af295
SHA256

6c7874a7760fd8143235433c91a9d6f32e34115382f3dda4a6aca5907a9316a7
SHA512

b52a6122326c2d27e6ff438ca3b6784b6e79db67cc6976b397c6f4793eb4e1caa7a2fb78ee4cdacb382a321c66b8a3cc0f5efaed2375ce20ed71cd0dc0bd6c27
SSDEEP

12288:KXzO1KmuDOwcuYJXWf1HJhC8nwVRaAwwebhD:KjOJBwcupf1WtmALe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
87493e622eefbf8106cde3a8ce807c60_JaffaCakes118

Files

87493e622eefbf8106cde3a8ce807c60_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0d436e17493b4cab6f8fe4fe5625145a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcessId
GetCommandLineW
lstrlenW
GetOEMCP
SizeofResource
DeleteCriticalSection
TerminateProcess
GetEnvironmentStringsW
WaitForMultipleObjects
FindResourceW
GetFileAttributesA
Sleep
InterlockedDecrement
CloseHandle
CreateFileA
FileTimeToSystemTime
HeapFree
FreeLibrary
HeapReAlloc
LCMapStringW
GlobalAlloc
CreateEventA
TlsSetValue
GetTickCount
SetEvent
GetVersionExW
GetVersionExA
GetACP
FreeEnvironmentStringsW
lstrlenA
GetProcessHeap
LocalAlloc
GetModuleHandleA
InterlockedIncrement
CreateEventW
ExitProcess
ReadFile
QueryPerformanceCounter
LocalFree
ResetEvent
FindClose
GlobalFree
InterlockedExchangeAdd
SetStdHandle
InterlockedCompareExchange
GetStdHandle
CreateFileW
GetCurrentThread
GetEnvironmentStrings
CreateMutexA
GetCommandLineA
CompareStringW
CompareStringA
InterlockedExchange
VirtualAlloc
GetStartupInfoA
GetVersion
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
WideCharToMultiByte
SetHandleCount
GetFileType
GetCurrentThreadId
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
GetCPInfo
HeapAlloc
IsBadWritePtr
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
GetStringTypeA
GetStringTypeW
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetTimeZoneInformation
GetLocaleInfoW
SetEnvironmentVariableA

shell32

SHCreateQueryCancelAutoPlayMoniker

iphlpapi

GetTcpStatisticsEx

Sections

.text
Size: 372KB - Virtual size: 371KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.code
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0d436e17493b4cab6f8fe4fe5625145a

Headers

File Characteristics

Imports

kernel32

shell32

iphlpapi

Sections

.text Size: 372KB - Virtual size: 371KB

.code Size: 12KB - Virtual size: 10KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 16KB - Virtual size: 24KB

.rsrc Size: 20KB - Virtual size: 16KB

.text
Size: 372KB - Virtual size: 371KB

.code
Size: 12KB - Virtual size: 10KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 16KB - Virtual size: 24KB

.rsrc
Size: 20KB - Virtual size: 16KB