af2a75830b12fe07c22d8568aa8b1ca4_JaffaCakes118

General

Target

af2a75830b12fe07c22d8568aa8b1ca4_JaffaCakes118
Size

215KB
MD5

af2a75830b12fe07c22d8568aa8b1ca4
SHA1

bc8c169c089efffc7112a410824c743556522a3b
SHA256

1a20722a21a72d5a9ba258baf35ab5624eeeb93477d1a3ff33823783afc380f7
SHA512

bf9129cf4de9428350d1841afdd0827ad433c052ffe0766da4e2509293c7d9e681c4835f5a7d3b8a3203d652e805d113c89f55510f4c33f5d40a9086643766ea
SSDEEP

3072:c9gwsReSqHbYh4Gzq1e0NuX4uzMSNC1846zC6XQ6g0dMsLGxntXBcKxBQq:aMReSq7YyGz4HNu/MIoX6zC6g+MBBqq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af2a75830b12fe07c22d8568aa8b1ca4_JaffaCakes118

Files

af2a75830b12fe07c22d8568aa8b1ca4_JaffaCakes118
.exe windows:5 windows x86 arch:x86

3b0b3c47bff463250d55803550b56025

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

ZwSetEvent
RtlExitUserThread
NtWriteFile
NtProtectVirtualMemory
RtlCompareString
ZwOpenMutant
NtReadFile
NtQueryInformationProcess
RtlInitUnicodeString

kernel32

Sleep
FreeEnvironmentStringsA
TlsAlloc
GetModuleHandleA
WaitForMultipleObjects
GetFileAttributesW
FlushFileBuffers
GetCurrentThread
LocalAlloc
GetLastError
InterlockedDecrement
GlobalAlloc
ReadFile
GetStringTypeW
GetOEMCP
TlsGetValue
GetLocaleInfoA
SetCurrentDirectoryW
GetFileType
LoadLibraryA
GetProcAddress
GetStartupInfoW
SetStdHandle
OpenFile
HeapDestroy
lstrcatA
GetTempPathA
SetThreadPriority
GetStringTypeA
GetEnvironmentStrings
SetProcessWorkingSetSize
SetPriorityClass
CompareFileTime
GetCurrentProcess
CloseHandle
CreateThread
IsBadCodePtr
FreeLibrary
GetSystemTime
HeapSize
GetCurrentDirectoryW
GetLocalTime
lstrcpyA
FreeEnvironmentStringsW
LCMapStringA
GetCPInfo
DeleteFileA
CreateFileA
GetLogicalDrives
InitializeCriticalSection
Beep
SearchPathA
GetCurrentThreadId
GetSystemDefaultLCID

Sections

.text
Size: 167KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3b0b3c47bff463250d55803550b56025

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

Sections

.text Size: 167KB - Virtual size: 167KB

.data Size: 44KB - Virtual size: 44KB

.rsrc Size: 3KB - Virtual size: 4KB

.text
Size: 167KB - Virtual size: 167KB

.data
Size: 44KB - Virtual size: 44KB

.rsrc
Size: 3KB - Virtual size: 4KB