af02bca0f00af362388e7a1f9de4e63e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

af02bca0f00af362388e7a1f9de4e63e_JaffaCakes118
Size

613KB
MD5

af02bca0f00af362388e7a1f9de4e63e
SHA1

e77c561550db804c566367849fa0e7309b07667a
SHA256

dbb84bade368e4e2cbd710bfbdc233cca46859893bd7af7af091403566ff8860
SHA512

326d18c694339b214a27071e224535f5fd17d9a3a43c99fd95c9b960e08360deffee964c90e7c72ada539c6fa90f2139eef0f9e7ba72432487409b1cca29590a
SSDEEP

12288:7IjgxMPVLmEztxKULi5lqmLP/RkLRjNffuerL74T/rTJRYFkGh9Lnh9aqk8:sSMPVLxztxKUmnqQP/uLRFrLkrTsh1aj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af02bca0f00af362388e7a1f9de4e63e_JaffaCakes118

Files

af02bca0f00af362388e7a1f9de4e63e_JaffaCakes118
.exe windows:5 windows x86 arch:x86

bba5453d317e8250f63f432ca7f086b6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

BuildCommDCBAndTimeoutsA
ReadConsoleA
SetConsoleActiveScreenBuffer
CreateJobObjectW
ConnectNamedPipe
CallNamedPipeW
SetTapeParameters
GetProcessPriorityBoost
LocalFlags
SetCommState
GlobalAlloc
LoadLibraryW
TerminateThread
ReadFile
lstrcatA
GetBinaryTypeW
GetACP
lstrlenW
FindNextVolumeMountPointW
RaiseException
InterlockedExchange
SetCurrentDirectoryA
SetEndOfFile
FreeLibraryAndExitThread
SetLastError
GetProcAddress
CopyFileA
EnterCriticalSection
GetLocalTime
IsSystemResumeAutomatic
FindAtomA
GetPrivateProfileStructA
GetTapeParameters
WaitForMultipleObjects
SetEnvironmentVariableA
CreateMutexA
EnumResourceNamesA
GetCurrentDirectoryA
OpenSemaphoreW
GetProfileSectionW
lstrcpyW
AreFileApisANSI
GetStdHandle
SetPriorityClass
CreateFileA
GetLastError
MoveFileA
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
HeapFree
DeleteCriticalSection
LeaveCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
HeapSize
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetCPInfo
GetOEMCP
IsValidCodePage
MultiByteToWideChar
GetModuleHandleA
GetLocaleInfoA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
CloseHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
SetStdHandle

advapi32

SetThreadToken
RevertToSelf

winhttp

WinHttpCloseHandle

Exports

Exports

_asdga@4
_weewgg@8
_wsefwrgwrg@4
_ydtiuiei7@8

Sections

.text
Size: 577KB - Virtual size: 576KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bba5453d317e8250f63f432ca7f086b6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

winhttp

Exports

Exports

Sections

.text Size: 577KB - Virtual size: 576KB

.rdata Size: 13KB - Virtual size: 12KB

.data Size: 7KB - Virtual size: 4.0MB

.rsrc Size: 14KB - Virtual size: 14KB

.text
Size: 577KB - Virtual size: 576KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 7KB - Virtual size: 4.0MB

.rsrc
Size: 14KB - Virtual size: 14KB