95cf145f121bda2c0ecec79fd8203126_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

95cf145f121bda2c0ecec79fd8203126_JaffaCakes118
Size

43KB
MD5

95cf145f121bda2c0ecec79fd8203126
SHA1

7fdab7e16bebb73479be7b3b31c711c36eab714a
SHA256

4851df35ac6ae0a6f662b4d27a64b84a8aa2afc96e8e36f6670726cba03a2225
SHA512

5e544feb2b9076d3b5cc381b6a703f692f9eed26addc7ec82faaaf069d2dd72d9b1b7037dadaa3a22c1c155c38bd696910f30296ff4f4309627ac1ed3721c0de
SSDEEP

768:naCBUdKqjxsHbTIjOdXxXRviswRTvc1/5QFTtDUFm5ds2DwfTf:Ioqj3OdXxXRvXW55ImAZb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
95cf145f121bda2c0ecec79fd8203126_JaffaCakes118

Files

95cf145f121bda2c0ecec79fd8203126_JaffaCakes118
.exe windows:5 windows x86 arch:x86

8beb29ed69d528414b6aa0fef5d8abe1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\svn\cscr-cue-cluster-1\scan\Copy_Stub\Release\hpfccopy.pdb

Imports

mfc90u

ord801
ord899
ord939
ord286
ord2694
ord813
ord2447
ord794
ord4448
ord4423
ord6801
ord4173
ord6803
ord4747
ord2251
ord2206
ord6035
ord4179
ord1048
ord5548
ord6741
ord5830
ord4213
ord2087
ord3217
ord5674
ord5676
ord938
ord4996
ord5680
ord5663
ord6018
ord2771
ord2983
ord3112
ord4728
ord2966
ord3115
ord2774
ord2893
ord2764
ord4080
ord4081
ord4071
ord2891
ord4348
ord4905
ord4681
ord3670
ord589
ord4043
ord296
ord2537
ord1314
ord600
ord1137
ord4347
ord1272

msvcr90

__argc
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
_except_handler4_common
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
memset
__wargv
__iob_func
fwprintf
wcschr
__CxxFrameHandler3

kernel32

GetTickCount
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
_lclose
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
CreateProcessW
CreateFileW
_llseek
WriteFile
CloseHandle

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

ole32

CoInitialize
CoUninitialize

oleaut32

SysFreeString

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

wwvpqnz
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8beb29ed69d528414b6aa0fef5d8abe1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfc90u

msvcr90

kernel32

advapi32

ole32

oleaut32

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 1024B - Virtual size: 2KB

.rsrc Size: 30KB - Virtual size: 31KB

wwvpqnz Size: - Virtual size: 4KB

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 1024B - Virtual size: 2KB

.rsrc
Size: 30KB - Virtual size: 31KB

wwvpqnz
Size: - Virtual size: 4KB