b97bd129084a646da961ee1811a82b0d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b97bd129084a646da961ee1811a82b0d_JaffaCakes118
Size

68KB
MD5

b97bd129084a646da961ee1811a82b0d
SHA1

b7cd0dca558b6f1272b69785cc06c0f6f468af59
SHA256

b6b70132c17e0a18467340d5fdde42a86ed3958aa2d05d4fa3718568c7d0a94c
SHA512

bcf5989232142c550a694a2a6251303287bf21cb9985bbdd1edd3016413008185bf9844f84f576e6676d33e1d58c0c6b45a56150cbc8dc11f1cc038635476902
SSDEEP

1536:Ulr+ObWz3OP+aZKyGxb98HJ4R7XMuByitX:+NbWjzCKyGx98p4FXz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b97bd129084a646da961ee1811a82b0d_JaffaCakes118

Files

b97bd129084a646da961ee1811a82b0d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f6b5c3c91b16dd393af0117d6f2959c5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

davcdata.pdb

Imports

kernel32

SetEvent
OpenProcess
CloseHandle
DuplicateHandle
GetCurrentProcess
InterlockedIncrement
GetCurrentProcessId
ExitProcess
DeleteTimerQueueTimer
InterlockedExchange
WaitForMultipleObjects
CreateThread
CreateEventA
CreateTimerQueueTimer
DisconnectNamedPipe
ReadFile
ConnectNamedPipe
CreateNamedPipeA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCommandLineA
GetVersionExA
RtlUnwind
RaiseException
GetModuleHandleA
WriteFile
GetStdHandle
GetModuleFileNameA
InterlockedDecrement
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
HeapAlloc
HeapReAlloc
HeapSize
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
IsBadWritePtr
VirtualQuery
IsBadReadPtr
IsBadCodePtr
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualProtect
GetSystemInfo
InterlockedCompareExchange
Sleep
LoadLibraryExW
GetProcAddress
FreeEnvironmentStringsA
GetLastError
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
SetLastError
lstrcatW
lstrcpyW
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
ResetEvent
EnterCriticalSection
LeaveCriticalSection
InterlockedExchangeAdd
CreateMutexW
ReleaseMutex

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor

user32

wsprintfW

rpcrt4

UuidCreate

Sections

.text
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

jvorklz
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f6b5c3c91b16dd393af0117d6f2959c5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

user32

rpcrt4

Sections

.text Size: 38KB - Virtual size: 38KB

.data Size: 1024B - Virtual size: 9KB

.rsrc Size: 28KB - Virtual size: 29KB

jvorklz Size: - Virtual size: 4KB

.text
Size: 38KB - Virtual size: 38KB

.data
Size: 1024B - Virtual size: 9KB

.rsrc
Size: 28KB - Virtual size: 29KB

jvorklz
Size: - Virtual size: 4KB