cf3f71ac6b19ffcc303d14f8829319f1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

cf3f71ac6b19ffcc303d14f8829319f1_JaffaCakes118
Size

181KB
MD5

cf3f71ac6b19ffcc303d14f8829319f1
SHA1

741276df9d0d07b60f1c86a18cee24e5dcd6fe17
SHA256

73b817a54507a196515e445cd0dcd438866aa08cf71d500c8451a529b419c836
SHA512

6df7ee4b1281b1320b1d57d75d3cd05a723724208243fdb16bcc8e371edff1a00d915539f968e890be011a1b674cd35dbd2acbc87e28dddd69c52d610745815c
SSDEEP

3072:4XwTBEpsiuzt5DOd5LoUrRMRbJYuhdxGJtWhvNPL5U8D:4ATusi8gpfRM9JYuhdoe/Wk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf3f71ac6b19ffcc303d14f8829319f1_JaffaCakes118

Files

cf3f71ac6b19ffcc303d14f8829319f1_JaffaCakes118
.exe windows:5 windows x86 arch:x86

8228d4b2f62e26c53396adbd3e487aa7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

g:\selfback\miansha(withoutshipin)\MyClient\Loader.pdb

Imports

kernel32

CopyFileW
GetTempFileNameW
GetTempPathW
GetModuleFileNameW
GetVersionExW
CloseHandle
CreateRemoteThread
GetProcAddress
WriteProcessMemory
VirtualAllocEx
OpenProcess
GetModuleHandleW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetStartupInfoW
WriteFile
CreateFileW
LockResource
GlobalAlloc
LoadResource
SizeofResource
FindResourceW
SetFileTime
GetFileInformationByHandle
GetSystemDirectoryW
WinExec
ExpandEnvironmentStringsW
GetWindowsDirectoryW
GetCommandLineW
CreateProcessW
DeleteFileW
GlobalFree
Sleep
GetCommandLineA
GetStartupInfoA
MultiByteToWideChar
GetLastError
ReadFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
HeapFree
SetFilePointer
RtlUnwind
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetStdHandle
HeapAlloc
VirtualAlloc
HeapReAlloc
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetEndOfFile
GetProcessHeap
CreateFileA
HeapSize
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

shell32

ord680

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8228d4b2f62e26c53396adbd3e487aa7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shell32

Sections

.text Size: 43KB - Virtual size: 43KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 10KB

.rsrc Size: 122KB - Virtual size: 121KB

.text
Size: 43KB - Virtual size: 43KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 10KB

.rsrc
Size: 122KB - Virtual size: 121KB