a3a0558586e8918c1cc607f062eb38f1_JaffaCakes118

General

Target

a3a0558586e8918c1cc607f062eb38f1_JaffaCakes118
Size

77KB
MD5

a3a0558586e8918c1cc607f062eb38f1
SHA1

f3ab2f06e5aabbba4fcfa4f774d721f2c27b6bcb
SHA256

2c2804faebd468f0e3bfd63c5636d3d44f19d60a1f0bec39f55c2eef608a11a0
SHA512

461915f420d9eca1fe32cb76985262375f1ccc83d51c87bc776d3b9c7137d9fae6457fa63e23beafb08da7bf8a89e4e73712fd38d3750cc10012bfe4f3713e0c
SSDEEP

1536:SIXaGEIYlWGQVQO9I1NOk/oiObbrD11/F2t4LReT5:SIgD0eOO1NlZObXD11N2tPN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a3a0558586e8918c1cc607f062eb38f1_JaffaCakes118

Files

a3a0558586e8918c1cc607f062eb38f1_JaffaCakes118
.dll windows:4 windows x86 arch:x86

50c7c876e75021ec70d5dc06722c2076

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

decrapifoier.pdb

Imports

kernel32

lstrcatW
GetEnvironmentStringsW
TerminateProcess
FreeEnvironmentStringsA
IsBadCodePtr
GetTickCount
IsBadWritePtr
IsBadReadPtr
InterlockedExchangeAdd
EnterCriticalSection
DeleteCriticalSection
SetEvent
CreateTimerQueueTimer
HeapDestroy
QueryPerformanceCounter
GetFileType
GetLocaleInfoA
SetLastError
GetModuleFileNameA
WaitForMultipleObjects
HeapFree
DisconnectNamedPipe
UnmapViewOfFile
CreateNamedPipeA
GetCurrentProcessId
GetCPInfo
SetUnhandledExceptionFilter
InitializeCriticalSection
LeaveCriticalSection
DeleteTimerQueueTimer
GetACP
GetEnvironmentStrings
GetStdHandle
InterlockedCompareExchange
LCMapStringA
ReleaseMutex
WaitForSingleObject
InterlockedExchange
GetSystemInfo
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
ResetEvent
WriteFile
OpenProcess
LCMapStringW
HeapAlloc
CreateMutexW
CreateEventA
WideCharToMultiByte
GetCurrentThreadId
GetSystemTimeAsFileTime
InterlockedDecrement
GetStartupInfoA
GetOEMCP
ConnectNamedPipe
FreeEnvironmentStringsW
lstrcpyW
GetLastError
DuplicateHandle
RtlUnwind
GetVersionExA
UnhandledExceptionFilter

user32

DrawIcon
CreateIconFromResource
wsprintfW
LoadIconA

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor

Exports

Exports

llzep

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 684B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

50c7c876e75021ec70d5dc06722c2076

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 56KB

.data Size: 18KB - Virtual size: 47KB

.rsrc Size: 1024B - Virtual size: 760B

.reloc Size: 1024B - Virtual size: 684B

.text
Size: 56KB - Virtual size: 56KB

.data
Size: 18KB - Virtual size: 47KB

.rsrc
Size: 1024B - Virtual size: 760B

.reloc
Size: 1024B - Virtual size: 684B