c8ebeb29fed842a6d586c1d91808e45d_JaffaCakes118

General

Target

c8ebeb29fed842a6d586c1d91808e45d_JaffaCakes118
Size

38KB
MD5

c8ebeb29fed842a6d586c1d91808e45d
SHA1

b63b88be9c6f8efb5e1eae3182ab43f6ebdc3fd6
SHA256

a11ad81a50a8168185a0557ad5973d8a8389aceac1ea7d6e96ddfcdaa35dd477
SHA512

7ad992a3e8a7dc97828bd2afa6d1bf02340b4c06a6555a853bbb360cd16c75e705048471940344c38fded01c1eb3f509899fb5048cbbdd4209ad3adabb8e694b
SSDEEP

768:oAbOmVXOZCj0r2ubCzM57DTHSmDSyGp04rGJ3UZp6ZeN:bbO4XkCj0rmM57DTRi04KJepNN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c8ebeb29fed842a6d586c1d91808e45d_JaffaCakes118

Files

c8ebeb29fed842a6d586c1d91808e45d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

7944097ac66d467cd2ffc968e3944cee

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

wcscpy
_stricmp
_iob
rand
atoi
??3@YAXPAX@Z
__getmainargs
__mb_cur_max

kernel32

InterlockedExchange
GetLocalTime
GetStdHandle
InterlockedDecrement
GetThreadLocale
GetACP
GetProcessHeap
GetCommandLineW
InterlockedIncrement
GetSystemInfo
UnmapViewOfFile
GetProcAddress
SetFilePointer

ulib

??0PATH@@QAE@XZ
?GetStandardOutput@PROGRAM@@UAEPAVSTREAM@@XZ
??0FLAG_ARGUMENT@@QAE@XZ
?Initialize@FSN_FILTER@@QAEEXZ
??0LONG_ARGUMENT@@QAE@XZ
??1PROGRAM@@UAE@XZ
?Initialize@PATH@@QAEEPBV1@E@Z
??1STRING_ARGUMENT@@UAE@XZ
?QueryDirectory@SYSTEM@@SGPAVFSN_DIRECTORY@@PBVPATH@@E@Z

ntdll

RtlInitializeBitMap
RtlUnicodeStringToAnsiString
NtQueryInformationFile
RtlAnsiStringToUnicodeString
NtWaitForMultipleObjects
_wcsicmp
NtTerminateThread
RtlUnwind
NtOpenProcessToken
RtlSystemTimeToLocalTime
RtlSetBits
RtlUnicodeToMultiByteN
NtSetEvent
NtWriteFile
isprint

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7944097ac66d467cd2ffc968e3944cee

Headers

File Characteristics

Imports

msvcrt

kernel32

ulib

ntdll

Sections

.text Size: 18KB - Virtual size: 18KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 2KB - Virtual size: 123KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 18KB - Virtual size: 18KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 2KB - Virtual size: 123KB

.reloc
Size: 4KB - Virtual size: 3KB