b211178bc668cc5fda20a716a5167697_JaffaCakes118

General

Target

b211178bc668cc5fda20a716a5167697_JaffaCakes118
Size

40KB
MD5

b211178bc668cc5fda20a716a5167697
SHA1

7a1ef4b08b0b60c1f7e0dcd20be3b1e923dac7d4
SHA256

cb075edc0ddf2d8367d6737fcfc7a0ace64a3a42c1eaece41de8896002d91b5c
SHA512

d43d7aefbe46a723dbecd09930d709f46d07557c434f51fdee9f40094aadf4004a0a1af18aa3ab653ff33d3fb8ae4af32654232f16994152c80ec30f769f53e8
SSDEEP

768:UH2FnmlRwbjy2jZZ4E3ykeHhQeehrfSITiyeq03r634saQ71Nxp+t:LFnsR+fjZa0/rfSJK03r6oXQ77xkt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b211178bc668cc5fda20a716a5167697_JaffaCakes118

Files

b211178bc668cc5fda20a716a5167697_JaffaCakes118
.exe windows:5 windows x86 arch:x86

fa2c6b94d7e82c3adf4d6ac4eb33b42f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalAlloc
lstrcatW
LoadLibraryA
GetFileType
GetModuleHandleA
GetCommandLineA
GetVersionExA
lstrcpyA
GetThreadLocale
GetUserDefaultLCID
InitializeCriticalSection
ExpandEnvironmentStringsW
lstrcatA
FindNextFileW
GetLastError
GlobalReAlloc
GlobalUnlock
OutputDebugStringA
GetVersion
GetCurrentThread
SetEndOfFile
SetCurrentDirectoryW

ntdll

NtDelayExecution
RtlComputeCrc32
RtlUnhandledExceptionFilter
RtlEnumerateGenericTableWithoutSplaying
wcscmp
NtSetInformationFile
RtlValidSecurityDescriptor
RtlExpandEnvironmentStrings_U

msvcrt

_pctype
toupper
_adjust_fdiv
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
__p__fmode
_wcsicmp
_acmdln
realloc
exit
__mb_cur_max
strchr
__initenv
__set_app_type
_iob

ulib

?Initialize@FSN_FILTER@@QAEEXZ
?Initialize@WSTRING@@QAEEPBDK@Z
??1OBJECT@@UAE@XZ
??0DSTRING@@QAE@XZ
?Get_Standard_Output_Stream@@YGPAVSTREAM@@XZ
?ValidateVersion@PROGRAM@@UBEXKK@Z
?Put@ARRAY@@UAEEPAVOBJECT@@@Z
?Initialize@STRING_ARGUMENT@@QAEEPAD@Z
?DisplayMessage@PROGRAM@@UBAEKW4MESSAGE_TYPE@@PADZZ
??0PROGRAM@@IAE@XZ
?DisplayMessage@PROGRAM@@UBEEKW4MESSAGE_TYPE@@@Z
?Strcat@WSTRING@@QAEEPBV1@@Z
?PutSwitches@ARGUMENT_LEXEMIZER@@QAEXPBD@Z
?Initialize@PATH@@QAEEPBVWSTRING@@E@Z
?PutSeparators@ARGUMENT_LEXEMIZER@@QAEXPBD@Z
?Compare@OBJECT@@UBEJPBV1@@Z

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fa2c6b94d7e82c3adf4d6ac4eb33b42f

Headers

File Characteristics

Imports

kernel32

ntdll

msvcrt

ulib

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 18KB - Virtual size: 18KB

.data Size: 3KB - Virtual size: 62KB

.rsrc Size: 1024B - Virtual size: 944B

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 18KB - Virtual size: 18KB

.data
Size: 3KB - Virtual size: 62KB

.rsrc
Size: 1024B - Virtual size: 944B