9a0b04c75d3f64bcd7c59632555f401d_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

9a0b04c75d3f64bcd7c59632555f401d_JaffaCakes118
Size

269KB
MD5

9a0b04c75d3f64bcd7c59632555f401d
SHA1

fe0731f820b46258100c37f49b412be39c976776
SHA256

e2d3e9a7819a89cffc3f614f62d44a8312eccea750e9fb0adac154ff5ea0f5f7
SHA512

51233be939dd3fb3df6b8700e79fdc2739e3f63c73ab3bc60450c4e593a1174c3a647608209d2d472e098a8daa94049aa9e6d62d6cebcf8ce3b26247fd938c8e
SSDEEP

6144:8JKIHlPW3P3ose/2t4zolRPKMAO13+OnUzhXVx:uKOlyoi4zYRnj3rKVx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9a0b04c75d3f64bcd7c59632555f401d_JaffaCakes118

Files

9a0b04c75d3f64bcd7c59632555f401d_JaffaCakes118
.dll windows:6 windows x86 arch:x86

31224beb591b9b3dd428df4a82400174

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\82\54\48\Flower\10\22\Teach\81\Fell\Sent\Column\rise\Fig\72\Try.pdb

Imports

kernel32

GetModuleFileNameA
Sleep
VirtualProtectEx
SetFilePointerEx
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
GetStringTypeW
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwind
RaiseException
InterlockedFlushSList
GetLastError
FreeLibrary
LoadLibraryExW
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
ExitProcess
GetACP
HeapReAlloc
HeapFree
WriteFile
OutputDebugStringW
CreateThread
HeapAlloc
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
HeapSize
CreateFileW

Exports

Exports

Bottomside
Insectplane
Joywill
Seasonyard
Yellowold

Sections

.text
Size: 182KB - Virtual size: 181KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 5.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

31224beb591b9b3dd428df4a82400174

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

Exports

Exports

Sections

.text Size: 182KB - Virtual size: 181KB

.rdata Size: 68KB - Virtual size: 68KB

.data Size: 6KB - Virtual size: 5.0MB

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 182KB - Virtual size: 181KB

.rdata
Size: 68KB - Virtual size: 68KB

.data
Size: 6KB - Virtual size: 5.0MB

.reloc
Size: 11KB - Virtual size: 10KB