c74656862b16f81d02c109030260245b_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

c74656862b16f81d02c109030260245b_JaffaCakes118
Size

456KB
MD5

c74656862b16f81d02c109030260245b
SHA1

53b97a9f6b4894d99386a42ab7196d83b719e012
SHA256

02db3c6b9aff73bf8a11c41107c836b6c800c919c5d3d1304f336aee03f79f4c
SHA512

ca9283c703e2bbbe2ef6a5291d8460663750a9bb9df41eeecc3bb6fef78db0a0b9a529a68c9b0ccbf288389bc9a42a4f654df4d3e2487bbdd7235ba285123c72
SSDEEP

12288:ggwIEzEGoC8SeBEpS/os40J/tZ3D6jTJ+yXh:gWEzWC85E40u/LEJlh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c74656862b16f81d02c109030260245b_JaffaCakes118

Files

c74656862b16f81d02c109030260245b_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b4779f685f6314bcaf3f3120fe94039b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\User\Desktop\2008\10.3.20\Effector_src\Effector\Release\Effector.pdb

Imports

ntdll

RtlUnwind
LdrGetProcedureAddress
LdrLoadDll
RtlInitAnsiString
_CIsqrt
_CIsin
_CIcos
RtlInitUnicodeString

kernel32

LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
CreateFileA
SetEndOfFile
GetLocaleInfoA
GetLocaleInfoW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
Sleep
WaitForSingleObject
CreateThread
ExitProcess
GetTickCount
MulDiv
InitializeCriticalSection
GetProcessHeap
WriteFile
FlushFileBuffers
GetLastError
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
HeapReAlloc
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
GetModuleHandleW
GetProcAddress
GetModuleHandleA
GetStdHandle
GetModuleFileNameA
MultiByteToWideChar
ReadFile
CloseHandle
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
RaiseException
HeapSize
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
InitializeCriticalSectionAndSpinCount
LoadLibraryA
CreateFileW
SetFilePointer
SetStdHandle

user32

TranslateMessage
SetRect
OffsetRect
EndDialog
PostQuitMessage
DefWindowProcW
DestroyWindow
DialogBoxParamW
UpdateWindow
ShowWindow
CreateWindowExW
RegisterClassExW
LoadCursorW
LoadIconW
DispatchMessageW
ReleaseDC
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
LoadStringW
GetDC

gdi32

GetTextExtentExPointW
DeleteObject
SelectObject
CreateFontW
GetDeviceCaps
SetDIBitsToDevice
GetGlyphOutlineW

Sections

.text
Size: 166KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 249KB - Virtual size: 249KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b4779f685f6314bcaf3f3120fe94039b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

kernel32

user32

gdi32

Sections

.text Size: 166KB - Virtual size: 165KB

.rdata Size: 33KB - Virtual size: 32KB

.data Size: 6KB - Virtual size: 16KB

.rsrc Size: 249KB - Virtual size: 249KB

.text
Size: 166KB - Virtual size: 165KB

.rdata
Size: 33KB - Virtual size: 32KB

.data
Size: 6KB - Virtual size: 16KB

.rsrc
Size: 249KB - Virtual size: 249KB