885390bf19115c75a6dca5a391ee0af8_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

885390bf19115c75a6dca5a391ee0af8_JaffaCakes118
Size

125KB
MD5

885390bf19115c75a6dca5a391ee0af8
SHA1

8b1799149d57879869489dac63df5f09c3adb10d
SHA256

62bb665aea2b83f1c9803f70dea7496957aa7ab37a56e928ae6a1af7bd2578f7
SHA512

0341dfd0e4fd55c706f4e322a67a5555c2f5a3d06317cfc864c5a24827ca63775beaf2dbbbe6cb4bd63cdf4bc7935cbd0c589ce004e2bc11e15d5e872cc679d8
SSDEEP

1536:nklzXIp7IDKGwDJ5XNIQlO+RZzDBtA9THonkBLRcE6ZiHsug:nsLIp7IDLwTXpO+RZ/ulcE6ZiHsug

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
885390bf19115c75a6dca5a391ee0af8_JaffaCakes118

Files

885390bf19115c75a6dca5a391ee0af8_JaffaCakes118
.exe windows:5 windows x86 arch:x86

2d24100424981c2a69da3902a4d4d900

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetModuleHandleA
GetModuleFileNameW
ExitProcess
FindNextFileW
GetDiskFreeSpaceExW
GetLogicalDrives
GetDriveTypeW
GetTickCount
GetConsoleOutputCP
GetStdHandle
SetConsoleOutputCP
GetConsoleScreenBufferInfo
SetConsoleScreenBufferSize
SetConsoleWindowInfo
GetVersionExA
FindClose
FindFirstFileW
MultiByteToWideChar
DeviceIoControl
FlushFileBuffers
SetFileTime
GetSystemTimeAsFileTime
SetFilePointer
ReadFile
SetFileAttributesW
DeleteFileW
WriteFile
GetFileSizeEx
CreateFileW
CloseHandle
GetCurrentProcess
FormatMessageW
WideCharToMultiByte
GetVolumeInformationW
GetLastError
GetConsoleCP
LoadLibraryW
RtlUnwind
GetCurrentProcessId
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
GetCommandLineW
HeapSetInformation
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
HeapSize
HeapReAlloc
IsProcessorFeaturePresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
HeapCreate
LCMapStringW
GetStringTypeW
Sleep
WriteConsoleW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetHandleCount
GetFileType
GetStartupInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetStdHandle

advapi32

FreeSid
EqualSid
GetTokenInformation
AllocateAndInitializeSid
SetTokenInformation
OpenProcessToken
CryptAcquireContextA
CryptDecrypt
CryptReleaseContext
CryptEncrypt
CryptSetKeyParam
CryptImportKey
CryptDestroyKey

shell32

ShellExecuteW
ord680

psapi

EnumProcessModules

mpr

WNetCloseEnum
WNetAddConnection2W
WNetEnumResourceW
WNetOpenEnumW

Sections

.text
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2d24100424981c2a69da3902a4d4d900

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

psapi

mpr

Sections

.text Size: 69KB - Virtual size: 69KB

.rdata Size: 33KB - Virtual size: 32KB

.data Size: 5KB - Virtual size: 12KB

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 69KB - Virtual size: 69KB

.rdata
Size: 33KB - Virtual size: 32KB

.data
Size: 5KB - Virtual size: 12KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 8KB - Virtual size: 8KB