a6084f157561c360866f8301c5d6f0e3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a6084f157561c360866f8301c5d6f0e3_JaffaCakes118
Size

84KB
MD5

a6084f157561c360866f8301c5d6f0e3
SHA1

7206bee3e5ab3105ce9b453442ce89c4491809b3
SHA256

aac42756d16b8f23619ba7cb18acb3fb1e8a6734b61821ce10028a23d0c3251c
SHA512

6ab66ed279d379cc37c28d6fe3aff84412cc603eaa1b0743a6613bdd49f75aa417e9cc82c79fea62fe99407872074477d78a6cfe29ed3456183b70a3a1e984e3
SSDEEP

1536:EUo5U5wFu7+gev2Zvdv4Ln+R+SvHVXYP7yyMIaMDXiE4/f:17PE2j47+RLv1XzFE4/f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a6084f157561c360866f8301c5d6f0e3_JaffaCakes118

Files

a6084f157561c360866f8301c5d6f0e3_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e201e0f34d447f8e546627ff04439f93

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindResourceW
GetCurrentProcessId
SetFilePointer
GetStartupInfoA
LockFileEx
LoadLibraryA
LoadLibraryExW
QueryMemoryResourceNotification
GetDefaultCommConfigW
QueryPerformanceCounter
VirtualAlloc
GetModuleHandleW
LZCopy
GetSystemTimeAsFileTime
AddAtomA
QueryDosDeviceA
GetOEMCP
GetTickCount
GetCurrentThreadId

msdart

?sm_wDefaultSpinCount@CSmallSpinLock@@1GA
?SetDefaultSpinAdjustmentFactor@CFakeLock@@SGXN@Z
?ConvertExclusiveToShared@CReaderWriterLock@@QAEXXZ
?IsEmpty@CLockedSingleList@@QBE_NXZ
?_H0@CLKRLinearHashTable@@ABEKK@Z
?WriteUnlock@CReaderWriterLock3@@QAEXXZ
?IsUnlocked@CLockedSingleList@@QBE_NXZ
?ConvertExclusiveToShared@CSmallSpinLock@@QAEXXZ
?GetSpinCount@CReaderWriterLock@@QBEGXZ
??0CFakeLock@@QAE@XZ
?WriteUnlock@CSpinLock@@QAEXXZ
?DeleteKey@CLKRHashTable@@QAE?AW4LK_RETCODE@@K@Z

olecli32

DefCreateFromClip
OleSaveToStream
LeActivate
DibClone
ErrShow
ErrSetTargetDevice
MfRelease
MfClone
OleSetHostNames
BmEqual
ErrSetUpdateOptions
OleCreateFromFile
ErrExecute
LeEnumFormat
OleRevokeClientDoc
ObjQueryType
LeObjectConvert

msvcrt

_stricoll
_msize
wcspbrk
_wcslwr
__p__mbctype
_rotr
_findclose
div
_heapwalk
__set_app_type
fprintf
_ultoa
__p__commode
_aligned_offset_realloc
_fcvt
_timezone
_stat
__getmainargs

Sections

.text
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e201e0f34d447f8e546627ff04439f93

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msdart

olecli32

msvcrt

Sections

.text Size: 32KB - Virtual size: 32KB

.rdata Size: 10KB - Virtual size: 9KB

.data Size: 20KB - Virtual size: 44KB

.rsrc Size: 20KB - Virtual size: 19KB

.reloc Size: 512B - Virtual size: 328B

.text
Size: 32KB - Virtual size: 32KB

.rdata
Size: 10KB - Virtual size: 9KB

.data
Size: 20KB - Virtual size: 44KB

.rsrc
Size: 20KB - Virtual size: 19KB

.reloc
Size: 512B - Virtual size: 328B