b510b319093c025dc6bc07150274cdd6_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

b510b319093c025dc6bc07150274cdd6_JaffaCakes118
Size

1.2MB
MD5

b510b319093c025dc6bc07150274cdd6
SHA1

0958a07771f7297db8c0478a4dc546ebc9ba1202
SHA256

48aaef4ea969d2bbd8f8df90d503ab61bf11603c1418fd10ecbaad76c9cd8548
SHA512

17c9ef8c56a0697584608406c3770bf95e6a5a0f4119b99c288751d7d3fb52b7a31cbc4dcbe50100fe61659362fe64e2dc33f9578b9fce21df2b0e6fd201acbd
SSDEEP

24576:PFTh7MY07yRmPROC9Gkx6KlOzpyhvzOw3vwfJ88BymVW+oDHP+:PFNj07yRmUqlYyhMfJ8OymboDv+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b510b319093c025dc6bc07150274cdd6_JaffaCakes118

Files

b510b319093c025dc6bc07150274cdd6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

59c7376aa79c0751a723274e8861dd12

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

b:\source\source.IC\11758\Release_WDExe_74\Release\WDExe.pdb

Imports

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
isdigit
vsprintf
_mbclen
_mbsinc
_ismbcspace
atoi
realloc
_mbctoupper
_mbspbrk
_mbsrchr
_makepath
_stati64
memmove
_mbsstr
wcscat
wcschr
_mbschr
memchr
_vsnprintf
wcslen
_stricmp
_mbscmp
gmtime
time
free
malloc
_mbsnbicmp
_mbsnbcpy
sprintf
memset
strlen
strncmp
memcpy
_mbsicmp
strcat
strcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
_CxxThrowException

kernel32

UnmapViewOfFile
RaiseException
CreateThread
TerminateThread
ResumeThread
CreateProcessA
InterlockedExchange
MultiByteToWideChar
CompareStringA
GetCurrentThreadId
TlsFree
TlsAlloc
VirtualProtect
VirtualQuery
TlsGetValue
TlsSetValue
GetFullPathNameA
FileTimeToSystemTime
FileTimeToLocalFileTime
FindNextFileA
SetFileAttributesA
GetFileAttributesA
FindClose
FindFirstFileA
CreateDirectoryA
CopyFileA
MoveFileA
DeleteFileA
GetVersion
SetEndOfFile
FlushFileBuffers
UnlockFile
LockFile
SetFilePointer
WriteFile
SetLastError
CreateFileA
SetErrorMode
WideCharToMultiByte
GetDriveTypeA
GetVolumeInformationA
GetLogicalDriveStringsA
GetFileInformationByHandle
lstrlenA
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateMailslotA
ExpandEnvironmentStringsA
GetLocalTime
GetComputerNameA
ReadFile
GetMailslotInfo
GetCommandLineA
GetPrivateProfileStringA
GetPrivateProfileIntA
LocalFree
FormatMessageA
LoadLibraryA
GetModuleFileNameA
GetProcAddress
FreeLibrary
GetSystemDefaultLangID
FindResourceA
LoadResource
LockResource
FreeResource
GetProfileStringA
Sleep
GetExitCodeProcess
CloseHandle
CreateFileMappingA
GetLastError
MapViewOfFile
OpenFileMappingA
GetVersionExA
GetModuleHandleA
CreateEventA
GetStartupInfoA
MulDiv
SetEvent
CreateMutexA
WaitForSingleObject
ReleaseMutex
GetCurrentProcessId
GetTempPathA
GetTempFileNameA

Exports

Exports

CommandeComposante
DeclareProxy
LibereMutex

Sections

.text
Size: 64KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

59c7376aa79c0751a723274e8861dd12

Headers

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 64KB - Virtual size: 61KB

.rdata Size: 24KB - Virtual size: 21KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 80KB - Virtual size: 78KB

.text
Size: 64KB - Virtual size: 61KB

.rdata
Size: 24KB - Virtual size: 21KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 80KB - Virtual size: 78KB