c1b287c53539470cc7cf02d948239e63_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c1b287c53539470cc7cf02d948239e63_JaffaCakes118
Size

224KB
MD5

c1b287c53539470cc7cf02d948239e63
SHA1

7f45a1d01769502eb90e4ac671ed03acc34c3082
SHA256

905af9e1af9243901eba9fd829a62063aada7f5ab90b64057d0eaa311c1d5c35
SHA512

26291f7d12d2c520aed580cc504678b71ff7a15772cd95bf8b7a41313dde2b58493b005bfb14c3b73a3f3b46dbfe10baf5db6ae04f12a61c9e4c36cc97df1562
SSDEEP

6144:aZlJhEcNpPMm+CtEVRjNBPTSDiEXv4GGIBSCjc3hxuxGB:wnNum1tEdBbtMwgSPHB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c1b287c53539470cc7cf02d948239e63_JaffaCakes118

Files

c1b287c53539470cc7cf02d948239e63_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cb9a0e74311d2a5d938ec48dc16e7884

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

pdh

PdhComputeCounterStatistics
PdhConnectMachineA
PdhEnumObjectsA
PdhExpandCounterPathA
PdhExpandWildCardPathHA
PdhExpandWildCardPathA
PdhFormatFromRawValue
PdhGetRawCounterValue
PdhLookupPerfIndexByNameA
PdhLookupPerfNameByIndexA
PdhMakeCounterPathA
PdhSetDefaultRealTimeDataSource
PdhSetLogSetRunID
PdhSetQueryTimeRange
PdhUpdateLogFileCatalog

psapi

EmptyWorkingSet
EnumProcessModules
GetModuleInformation
GetProcessMemoryInfo
QueryWorkingSet

kernel32

HeapSize
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
LCMapStringW
LCMapStringA
SetConsoleCtrlHandler
GetStringTypeW
GetStringTypeA
ReadFile
SetStdHandle
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
IsBadCodePtr
IsBadReadPtr
GetVersionExA
GetUserDefaultLCID
EnumSystemLocalesA
CreateDirectoryA
CopyFileA
ResetEvent
VirtualFree
VirtualProtect
VirtualAlloc
GetProfileStringW
GetSystemWindowsDirectoryA
EnterCriticalSection
Sleep
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
RtlUnwind
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
RaiseException
HeapFree
FatalAppExitA
TerminateProcess
GetCurrentProcess
HeapReAlloc
HeapAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetCurrentThread
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
WriteFile
SetFilePointer
FlushFileBuffers
CloseHandle
SetUnhandledExceptionFilter
IsBadWritePtr
GetCPInfo
IsValidLocale
IsValidCodePage
GetLocaleInfoA

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 807KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cb9a0e74311d2a5d938ec48dc16e7884

Headers

File Characteristics

Imports

pdh

psapi

kernel32

Sections

.text Size: 68KB - Virtual size: 67KB

.rdata Size: 72KB - Virtual size: 68KB

.data Size: 68KB - Virtual size: 807KB

.reloc Size: 12KB - Virtual size: 8KB

.text
Size: 68KB - Virtual size: 67KB

.rdata
Size: 72KB - Virtual size: 68KB

.data
Size: 68KB - Virtual size: 807KB

.reloc
Size: 12KB - Virtual size: 8KB