d103984e144c7bc80be97c794dd8d8df_JaffaCakes118

General

Target

d103984e144c7bc80be97c794dd8d8df_JaffaCakes118
Size

200KB
MD5

d103984e144c7bc80be97c794dd8d8df
SHA1

5a941d9e1f111167f5f2b64f64c0bdefbe46e0a0
SHA256

24d7007c0c8f7696724e2aff1316aef9f83133c06011d03cdee7913551104f21
SHA512

d5d2d53f62d2db9e395732a2d6758da508721eed8e5aa23f3983ee7e569507aeaf3961da49ea5be0f94c5113108ca35b3bd66972506585f140f17cd867a21548
SSDEEP

1536:TKbc4umMqVx2L4YetGTnt/zcmAHcvxIsL9Yzcs0fMydWRyuTV7TJ3:T2fbntMBzcf8pIQ0PydwyuTVPJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d103984e144c7bc80be97c794dd8d8df_JaffaCakes118

Files

d103984e144c7bc80be97c794dd8d8df_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b4940d24f42eae07705704b2cdefab4a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentDirectoryA
GetLastError
GetTempPathA
CloseHandle
GetCurrentProcess
WriteFile
CreateFileA
LockResource
LoadResource
SizeofResource
FindResourceA
GetTempFileNameA
WaitForSingleObject
TerminateProcess
CreateProcessA
GetVersionExA
GetLocalTime
SetLocalTime
SetLastError
Sleep
HeapFree
HeapAlloc
RtlUnwind
GetCommandLineA
GetProcessHeap
GetStartupInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetProcAddress
GetModuleHandleA
ExitProcess
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSection
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
HeapSize
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b4940d24f42eae07705704b2cdefab4a

Headers

File Characteristics

Imports

kernel32

advapi32

Sections

.text Size: 36KB - Virtual size: 33KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 8KB - Virtual size: 7KB

.rsrc Size: 68KB - Virtual size: 65KB

.text
Size: 36KB - Virtual size: 33KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 68KB - Virtual size: 65KB