be1979d89cc873f67467a450dc139522_JaffaCakes118

General

Target

be1979d89cc873f67467a450dc139522_JaffaCakes118
Size

181KB
MD5

be1979d89cc873f67467a450dc139522
SHA1

6670438e3810d5773684acaf5acd646780f15b27
SHA256

1b0e170545cc9407e0f6c5219171495f4dac6d4561e11c923c416224ec54ebce
SHA512

8d3a3f64bb9392998f576bacad654a021c4465913ba1d3d23e5d9515bceeb8cdcfd5478b30271456ebb993c94b0f57521093efb1d055d39479720ebd1ab87623
SSDEEP

3072:JDsq11CalT8cq+0lwe3gEukyB0cUDgLUckINDkB0ZxMcpkdR7A05YPfcUPP:W4cDcq+0PYBXUDgZZNuAecpko0MPP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be1979d89cc873f67467a450dc139522_JaffaCakes118

Files

be1979d89cc873f67467a450dc139522_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8691050e00e4a4975b1a701969a4d75d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
CreateFileW
SetFilePointer
WriteFile
GetFileSize
GlobalAlloc
ExitProcess
GetCommandLineA
GetModuleFileNameA
GetModuleHandleA
GetTickCount
WriteProcessMemory
TlsSetValue
SetThreadContext
GetThreadContext
VirtualAlloc
GetProcAddress
LoadLibraryA
GetLastError
GetModuleFileNameW
GetSystemTime
lstrcatA
GetWindowsDirectoryA
ResumeThread
TlsGetValue
TlsAlloc
CreateThread
VirtualProtect
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
GetSystemInfo
MultiByteToWideChar
LCMapStringA
GetStartupInfoA
GetVersionExA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
InterlockedExchange
VirtualQuery
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
HeapReAlloc
HeapSize

user32

wsprintfA
GetWindowRect
GetWindowRgn

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8691050e00e4a4975b1a701969a4d75d

Headers

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 20KB - Virtual size: 18KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 170KB

.rsrc Size: 4KB - Virtual size: 640B

.text
Size: 20KB - Virtual size: 18KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 170KB

.rsrc
Size: 4KB - Virtual size: 640B