af39468d1f8b1f94d398cc615bdca968_JaffaCakes118

General

Target

af39468d1f8b1f94d398cc615bdca968_JaffaCakes118
Size

62KB
MD5

af39468d1f8b1f94d398cc615bdca968
SHA1

d0989de1e3be0281f8b444a523424609aaebfa4b
SHA256

ffebc8c734d6fe2ca6a553ad2b46d20e42bee5a3e8aa84cbfcd3db2c53620be5
SHA512

a8d0d3b749d0916ac07b060bedef77c2fd8f6d1cda0d068cc5ce3634f88efeac7271af99553e935762039a8c86397f87f4decaba010417d191eee0efcaf6d73a
SSDEEP

1536:Jbx2jitxCciXRwCVAgDStk+SgqgJsZmBfBfyWrITIn1wEQY:JbfxCcOwCTSLqysZmBZ6WsTI1wdY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af39468d1f8b1f94d398cc615bdca968_JaffaCakes118

Files

af39468d1f8b1f94d398cc615bdca968_JaffaCakes118
.exe windows:5 windows x86 arch:x86

c1daf4df5d8795fd4857986a92232174

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__getmainargs
time
_errno
_pctype
fputs
memmove
_strnicmp
fopen
__winitenv

kernel32

InterlockedDecrement
GetThreadLocale
InterlockedIncrement
GetConsoleOutputCP
GetCurrentThread
ResetEvent
InterlockedExchange
SetEvent
LocalAlloc
HeapReAlloc
lstrcatA
IsBadWritePtr
UnhandledExceptionFilter
DeviceIoControl
GetCommandLineA
GetSystemInfo
WaitForSingleObject
HeapCreate
GetVersion
GetStringTypeA

ntdll

RtlNewSecurityObject
NtQueryVirtualMemory
DbgBreakPoint
_wcsupr
RtlUnhandledExceptionFilter
RtlNumberOfSetBits

ulib

??1PATH@@UAE@XZ
??0PATH_ARGUMENT@@QAE@XZ
?Initialize@PATH_ARGUMENT@@QAEEPADE@Z
??0DSTRING@@QAE@XZ
??1ARGUMENT_LEXEMIZER@@UAE@XZ
?Initialize@FSN_FILTER@@QAEEXZ
??0FLAG_ARGUMENT@@QAE@XZ
??1PATH_ARGUMENT@@UAE@XZ
?GetStandardOutput@PROGRAM@@UAEPAVSTREAM@@XZ
?Put@ARRAY@@UAEEPAVOBJECT@@@Z
??1STRING_ARGUMENT@@UAE@XZ
?Initialize@WSTRING@@QAEEPBDK@Z
?Initialize@CLASS_DESCRIPTOR@@QAEEXZ

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c1daf4df5d8795fd4857986a92232174

Headers

File Characteristics

Imports

msvcrt

kernel32

ntdll

ulib

Sections

.text Size: 39KB - Virtual size: 39KB

.rdata Size: 17KB - Virtual size: 17KB

.data Size: 4KB - Virtual size: 76KB

.text
Size: 39KB - Virtual size: 39KB

.rdata
Size: 17KB - Virtual size: 17KB

.data
Size: 4KB - Virtual size: 76KB