a48ce5438105cf62197d7347a571338d_JaffaCakes118

General

Target

a48ce5438105cf62197d7347a571338d_JaffaCakes118
Size

111KB
MD5

a48ce5438105cf62197d7347a571338d
SHA1

3e3c6b1dda526413d0b56d058cb01660ccb5e750
SHA256

6264e95e9124567cc7368a6420759fc15bac4b52d0babaee3ece46bf592cb597
SHA512

e2a1d6df9ccf80a1ada60046a76d2748b5f88cfe6596127dfaa633e12055d4dbcd72e165f1a03f41fdd739e0c1192f9410c05f1ede66c06b92279d32b7bbd827
SSDEEP

3072:8ClbnA+uZMSie/IdG8xAh5BPnnvbOm+tBjQehgCKs2MC:8GbnA+uZMS1IdG8xAhzXKnXQuXKs2P

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a48ce5438105cf62197d7347a571338d_JaffaCakes118

Files

a48ce5438105cf62197d7347a571338d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bdefcf1f3723b5dd0aa080f824c26d40

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpyA
lstrcatA
GetSystemDirectoryA
TerminateProcess
ResumeThread
SetThreadContext
WriteProcessMemory
VirtualAllocEx
GetModuleHandleA
lstrcmpiA
GetModuleFileNameA
ReadProcessMemory
GetThreadContext
CreateProcessA
ExitProcess
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentProcess
WideCharToMultiByte
MultiByteToWideChar
OutputDebugStringA
DeleteFileA
MoveFileA
FreeResource
lstrlenA
WriteFile
SizeofResource
SetFileTime
LocalFileTimeToFileTime
FindFirstFileA
CreateFileA
LoadResource
FindResourceA
GetTickCount
GetTempPathA
SetLastError
GetWindowsDirectoryA
GetLastError
HeapFree
GetProcAddress
HeapAlloc
GetProcessHeap
ReadFile
SetFilePointer
GetPrivateProfileStringA
WritePrivateProfileStringA
CreateDirectoryA
GetFileAttributesA
SetUnhandledExceptionFilter
ReleaseMutex
CreateMutexA
GetCommandLineA
Sleep
CreateThread
WinExec
GetCurrentThreadId
LoadLibraryA
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
GetStartupInfoA

msvcrt

rand
strchr
strstr
realloc
malloc
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_strcmpi
memset
??3@YAXPAX@Z
strlen
_except_handler3
__CxxFrameHandler
memcpy
??2@YAPAXI@Z

ntdll

ZwUnmapViewOfSection

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bdefcf1f3723b5dd0aa080f824c26d40

Headers

File Characteristics

Imports

kernel32

msvcrt

ntdll

Sections

.text Size: 15KB - Virtual size: 14KB

.rsrc Size: 95KB - Virtual size: 94KB

.text
Size: 15KB - Virtual size: 14KB

.rsrc
Size: 95KB - Virtual size: 94KB