8af14993de149f1b7119d15bf0675efd_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

8af14993de149f1b7119d15bf0675efd_JaffaCakes118
Size

72KB
MD5

8af14993de149f1b7119d15bf0675efd
SHA1

477d279e2dc20c9041181d62e52125b782a943d1
SHA256

285fd9079c10b2f94ba313148d61cfed6a26c645f0d35ff6bc4b8d1382b99729
SHA512

15cf9d62f59b9c45f5afffbc9885aa89a729ca0f45b87871c677c2255a6b9a22e7da6e26067653799a8f38dffaac711e2143e1a769e003cb60559df94dd9b9c9
SSDEEP

1536:JSJLAqlHQsEg/5djX/byxQmyl/rKKTqDoi:JSJLtH/5djaryl+MUoi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8af14993de149f1b7119d15bf0675efd_JaffaCakes118

Files

8af14993de149f1b7119d15bf0675efd_JaffaCakes118
.exe windows:5 windows x86 arch:x86

05f9e7ac3a2ca5724fd175cd3ce69fb2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Projects\XopeSystem-v3\XopeLoader\Release\XopeLoader.pdb

Imports

kernel32

CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetModuleFileNameW
OpenProcess
lstrlenW
WriteProcessMemory
GetProcAddress
GetModuleHandleW
CreateRemoteThread
WaitForSingleObject
VirtualFreeEx
GetCurrentProcess
CloseHandle
VirtualAllocEx
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetLastError
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize

advapi32

OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data0
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data1
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

05f9e7ac3a2ca5724fd175cd3ce69fb2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

Sections

.text Size: 26KB - Virtual size: 26KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 512B - Virtual size: 436B

.data0 Size: 3KB - Virtual size: 3KB

.data1 Size: 28KB - Virtual size: 27KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 26KB - Virtual size: 26KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 436B

.data0
Size: 3KB - Virtual size: 3KB

.data1
Size: 28KB - Virtual size: 27KB

.reloc
Size: 2KB - Virtual size: 1KB