950a36030b60ac9b57e71d81b28073ff_JaffaCakes118

General

Target

950a36030b60ac9b57e71d81b28073ff_JaffaCakes118
Size

109KB
MD5

950a36030b60ac9b57e71d81b28073ff
SHA1

1fb91ba8a0aaa325fd0e5748218514e430a8df98
SHA256

b60b7802cae9399751da2da2949f8c16c86e47724e8e237eb77434e94e4385a8
SHA512

52b0b2b64da674e84ea8d26e8dc1d3abfce9d09618d6842449f8450d039665b82c013925e188365904d97d320e701b10f2b63799eb38dcf5bf84d3bda6beb6db
SSDEEP

3072:ePOIUJijLtXBN3UJNd8TZrMkPMJxJXbdWj:CSJ4/3UJkvYXbd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
950a36030b60ac9b57e71d81b28073ff_JaffaCakes118

Files

950a36030b60ac9b57e71d81b28073ff_JaffaCakes118
.exe windows:5 windows x86 arch:x86

40b68ab4f5e2c8bee008068a34cbb637

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

OleInitialize
CoGetPSClsid
OleCreateLink
OleLoadFromStream
OleIsRunning
OleCreateLinkFromData
CoLockObjectExternal
CoGetCurrentProcess
CoCreateGuid
OleQueryLinkFromData
CoTaskMemFree
CoInstall
CoRegisterClassObject
CoSuspendClassObjects
OleCreateLinkFromDataEx
OleCreateEmbeddingHelper
CoUnmarshalInterface
OleGetClipboard
OleGetIconOfClass
CoGetClassObject
CoUninitialize

kernel32

VirtualLock
VirtualFree
GetModuleHandleW
GetCurrentThreadId
GetTickCount
GetCurrentProcessId
VirtualAlloc
lstrlen
InterlockedExchange
GetProcessAffinityMask
GetFileAttributesW
CreateMutexW
GetProcessShutdownParameters
SizeofResource
GlobalUnfix
OpenProfileUserMapping
DeleteFileW
GetLogicalDrives
LocalLock
WriteConsoleInputA
FatalExit
TermsrvAppInstallMode
EnumResourceNamesA
BeginUpdateResourceW
LocalFree

ntdll

RtlSetEnvironmentVariable
ZwOpenEventPair
RtlTraceDatabaseDestroy
ZwWaitHighEventPair
ZwOpenKey
ZwSetDefaultHardErrorPort
RtlOemStringToUnicodeString
RtlIdentifierAuthoritySid
ZwOpenThreadToken
RtlCopySid
RtlDnsHostNameToComputerName
RtlQueueWorkItem
RtlTraceDatabaseLock
NtQueryDirectoryObject
ZwWriteFile
ZwSetHighWaitLowEventPair
NtSetDefaultUILanguage
RtlEqualLuid

Sections

.text
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

40b68ab4f5e2c8bee008068a34cbb637

Headers

DLL Characteristics

File Characteristics

Imports

ole32

kernel32

ntdll

Sections

.text Size: 105KB - Virtual size: 104KB

.data Size: 1KB - Virtual size: 93KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 105KB - Virtual size: 104KB

.data
Size: 1KB - Virtual size: 93KB

.rsrc
Size: 1KB - Virtual size: 1KB