885c935f89580c98444c64b2710378d2_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

885c935f89580c98444c64b2710378d2_JaffaCakes118
Size

1016KB
MD5

885c935f89580c98444c64b2710378d2
SHA1

ec3a9cde30a280b825f9603ed6d2f346a24e27d5
SHA256

c0c99b141b014c8e2a5c586586ae9dc01fd634ea977e2714fbef62d7626eb3fb
SHA512

4f2c306cf06d09e6cf776c2a2947239982d27a058b4104875d00c8a623a8ceafeeba8a5b1afdf86c841aa0972f235556f7214e28c4fd8d1936237520c388c0be
SSDEEP

24576:LibnUPR2bYg1yiwKZycSQLyMTNuSBOpFhA8ld8Wm8/uyA:ubCR2bIoyqG4ZBObd8WmRyA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
885c935f89580c98444c64b2710378d2_JaffaCakes118

Files

885c935f89580c98444c64b2710378d2_JaffaCakes118
.exe windows:5 windows x86 arch:x86

be9bd9a047f58d9e74d98e29af6526db

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\sz\ConsoleApplication3\Release\ConsoleApplication3.pdb

Imports

kernel32

DeleteFileA
CloseHandle
HeapAlloc
GetFileSize
ExitProcess
GetProcessHeap
GlobalMemoryStatusEx
GetConsoleWindow
lstrcmpW
GetComputerNameA
SetEndOfFile
CreateFileW
CreateFileA
GetTempPathA
GetConsoleMode
Sleep
ReleaseMutex
CreateMutexA
FindClose
GetDriveTypeA
SetConsoleMode
WriteFile
FindNextFileW
HeapFree
SetEnvironmentVariableA
FreeEnvironmentStringsW
ReadConsoleW
GetLastError
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
SetFilePointerEx
WriteConsoleW
OutputDebugStringA
FindFirstFileW
GetLogicalDrives
SetStdHandle
ReadFile
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetExitCodeThread
GetNativeSystemInfo
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
OutputDebugStringW
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
RtlUnwind
RaiseException
HeapValidate
GetSystemInfo
GetModuleFileNameA
GetModuleHandleExW
ExitThread
GetStdHandle
GetCommandLineA
GetCommandLineW
GetACP
GetFileType
FlushFileBuffers
GetConsoleCP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
MoveFileExW
HeapReAlloc
HeapSize
HeapQueryInformation

user32

ShowWindow
DispatchMessageW
PeekMessageW
TranslateMessage

advapi32

CryptEncrypt
CryptDestroyHash
CryptHashData
CryptDestroyKey
CryptAcquireContextW
CryptReleaseContext
GetUserNameA
CryptCreateHash
CryptDeriveKey

shell32

ShellExecuteA

iphlpapi

GetTcpTable

ws2_32

connect
ntohs
htons
socket
send
inet_addr
WSAStartup
closesocket
WSACleanup
inet_ntoa

crypt32

CryptStringToBinaryA
CryptDecodeObjectEx
CryptImportPublicKeyInfo

Sections

.text
Size: 748KB - Virtual size: 748KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 214KB - Virtual size: 214KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

be9bd9a047f58d9e74d98e29af6526db

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

iphlpapi

ws2_32

crypt32

Sections

.text Size: 748KB - Virtual size: 748KB

.rdata Size: 214KB - Virtual size: 214KB

.data Size: 11KB - Virtual size: 17KB

.gfids Size: 5KB - Virtual size: 4KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 35KB - Virtual size: 35KB

.text
Size: 748KB - Virtual size: 748KB

.rdata
Size: 214KB - Virtual size: 214KB

.data
Size: 11KB - Virtual size: 17KB

.gfids
Size: 5KB - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 35KB - Virtual size: 35KB