b9bc42d8cc4ff418f9986bb88a4398af_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

b9bc42d8cc4ff418f9986bb88a4398af_JaffaCakes118
Size

165KB
MD5

b9bc42d8cc4ff418f9986bb88a4398af
SHA1

b780024545abfd0d3add4d2b35c4509ee10cc700
SHA256

ecadcb45965e6c4c0f9174f583e9491a1a3e84093e4ca540e11b5063d89adfbd
SHA512

256b7e6b9f9040ec1053f151c96f504f7450aa4775908f69b1f7e479972e9ec48bdb2942ba539b1844678822bd15f5867c62d16790aec9e1b66b487f405b086a
SSDEEP

3072:bRCTzAmKVL09VSV+BZCdmvSqRmX/aBNVPi8F:bK4dV+BZoqUX/a7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b9bc42d8cc4ff418f9986bb88a4398af_JaffaCakes118

Files

b9bc42d8cc4ff418f9986bb88a4398af_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5d9cb2c05ae267d642eb1abb4d5816cf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetCurrentDirectoryA
GetModuleHandleW
GetDriveTypeA
lstrcmpiW
lstrcmpiA
GetProcessHeap
GetCurrentProcess
GlobalFindAtomA
GetCurrentProcessId
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
DeleteFileA
MulDiv
GetThreadLocale
lstrlenW
GetCurrentThreadId
GetCommandLineW
lstrcmpA
GetUserDefaultLangID
CopyFileA
RemoveDirectoryA
GetCurrentThread
GetVersion
GlobalFindAtomW
GetModuleHandleA
GetWindowsDirectoryA
GetCommandLineA
GetACP
GetConsoleOutputCP
GetOEMCP
DeleteFileW
VirtualAlloc
VirtualFree
IsDebuggerPresent
lstrlenA

gdi32

LineTo
CreateCompatibleDC
SetTextColor
DeleteObject
CreateSolidBrush
CreatePen
CreateFontIndirectA
DeleteDC
GetDeviceCaps
SetTextAlign
SetStretchBltMode
PatBlt
GetObjectA
GetPixel
RectVisible
GetTextMetricsA
RestoreDC
CreatePalette
SetMapMode
SaveDC
SelectPalette
GetStockObject
GetClipBox

user32

TranslateMessage
GetDesktopWindow
GetSystemMetrics
CharNextA
GetDC
GetParent

glu32

gluNurbsCallback

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Poto Bij
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Ynykygaj
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5d9cb2c05ae267d642eb1abb4d5816cf

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

gdi32

user32

glu32

Sections

.text Size: 10KB - Virtual size: 10KB

Poto Bij Size: 512B - Virtual size: 4KB

.rdata Size: 25KB - Virtual size: 24KB

Ynykygaj Size: 512B - Virtual size: 4KB

.data Size: 100KB - Virtual size: 100KB

.rsrc Size: 27KB - Virtual size: 26KB

.text
Size: 10KB - Virtual size: 10KB

Poto Bij
Size: 512B - Virtual size: 4KB

.rdata
Size: 25KB - Virtual size: 24KB

Ynykygaj
Size: 512B - Virtual size: 4KB

.data
Size: 100KB - Virtual size: 100KB

.rsrc
Size: 27KB - Virtual size: 26KB