d13f34317f14c6e0a7ad968fcc8b8003_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d13f34317f14c6e0a7ad968fcc8b8003_JaffaCakes118
Size

268KB
MD5

d13f34317f14c6e0a7ad968fcc8b8003
SHA1

d02ac1d7e0f5242a5258a747d4b6a81f331bf000
SHA256

5441b3181d12dea6ecbcc0a1af0227c2ed4a5d3b882df9175e673156f47e97f2
SHA512

47d93f1a6f83ef7bc553332da234a76f5e33816f66faa1e3f81977f25171e43d680d6429de6e45bee98df8ea103dd85c57445916e60c8e555c2a79e15f6e67c8
SSDEEP

6144:tZhwBrnkQsbJmzLVy0J6eYhpgV97vPyuNXq:5LpszLVgeYhpgv7vPyM6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d13f34317f14c6e0a7ad968fcc8b8003_JaffaCakes118

Files

d13f34317f14c6e0a7ad968fcc8b8003_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6b682ab991cdc28610945d01443f820f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsDebuggerPresent
GetLastError
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
CreateEventW
lstrlenW
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
GetModuleFileNameW
WaitForMultipleObjects
SetEvent
MulDiv
GetModuleHandleW
WaitForSingleObject
LoadLibraryW
FreeLibrary
lstrcpynW
GetVersionExW
lstrcmpW
GetProcAddress
LoadLibraryA

user32

LoadIconW
GetFocus
SetCursor
CopyRect
GetIconInfo
DestroyIcon
IsWindow
GetSysColor
InvalidateRect
GetSystemMetrics
EnableWindow
LoadImageW
IsIconic
PostMessageW
SendMessageW
LoadCursorW

gdi32

GetStockObject
DeleteObject
CreatePen
CreateFontIndirectW
CreatePatternBrush
CreatePalette
CreateRectRgn
CreateCompatibleDC
CreateSolidBrush

comctl32

ord17

query

CIState
DllCanUnloadNow
BeginCacheTransaction
CiSvcMain
InitializeCIISAPIPerformanceData

mscat32

CryptCATEnumerateAttr
CryptCATAdminReleaseContext
MsCatConstructHashTag
CryptCATStoreFromHandle
CryptCATGetCatAttrInfo

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 1KB - Virtual size: 273KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 2KB - Virtual size: 432KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 86KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 133KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6b682ab991cdc28610945d01443f820f

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comctl32

query

mscat32

Sections

.text Size: 9KB - Virtual size: 9KB

.text Size: 16KB - Virtual size: 16KB

.edata Size: 1KB - Virtual size: 273KB

.rdata Size: 2KB - Virtual size: 35KB

.edata Size: 2KB - Virtual size: 432KB

.edata Size: 86KB - Virtual size: 121KB

.data Size: 6KB - Virtual size: 363KB

.edata Size: 133KB - Virtual size: 150KB

.rsrc Size: 10KB - Virtual size: 10KB

.text
Size: 9KB - Virtual size: 9KB

.text
Size: 16KB - Virtual size: 16KB

.edata
Size: 1KB - Virtual size: 273KB

.rdata
Size: 2KB - Virtual size: 35KB

.edata
Size: 2KB - Virtual size: 432KB

.edata
Size: 86KB - Virtual size: 121KB

.data
Size: 6KB - Virtual size: 363KB

.edata
Size: 133KB - Virtual size: 150KB

.rsrc
Size: 10KB - Virtual size: 10KB