d38f179b057a7dd91cdca34db51a0c08_JaffaCakes118

General

Target

d38f179b057a7dd91cdca34db51a0c08_JaffaCakes118
Size

372KB
MD5

d38f179b057a7dd91cdca34db51a0c08
SHA1

ace630d040759e360c8145a2214b0152630b4b33
SHA256

9c2c62d4c59900ffbaa1d74d0f9694efcb20e82321646568c2fd7b2345fb3b3c
SHA512

a7bead564fd4b945b02560c7b60b67b1c88f99231d0706de9db04693a0ecd2ed9d8b95c06cf246c1cbf8c1c8011226b9a9421790bf5b5a7086c55294029dadf0
SSDEEP

6144:NR7/LHNoeTp1gm0rYMLOTvEBSq0w7xZ6s6igcnz/RfyhZ4TtbuIwx+BZGb0g5j:NVzdTp1gj0MLOT0SqRxo1igcz/UcTJuP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
d38f179b057a7dd91cdca34db51a0c08_JaffaCakes118

Files

d38f179b057a7dd91cdca34db51a0c08_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e0fbedb61f44b04c425dfb1f41f5789e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CopyFileA
GetTempPathA
GetWindowsDirectoryA
MoveFileExA
GetModuleFileNameA
GetProcAddress
ExitProcess
SizeofResource
LockResource
GetSystemTime
CloseHandle
OpenProcess
GetFileAttributesA
SetFileAttributesA
Sleep
GetModuleHandleA
VirtualAlloc
LCMapStringW
LCMapStringA
SetFilePointer
FlushFileBuffers
GetLastError
LoadLibraryA
HeapAlloc
GetStartupInfoA
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
HeapFree
HeapReAlloc
TerminateProcess
GetCurrentProcess
HeapSize
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
RtlUnwind
WriteFile
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
SetStdHandle

advapi32

RegOpenKeyExA
RegSetValueExA
RegCloseKey
GetUserNameA

shell32

ShellExecuteA

psapi

EnumProcessModules
GetModuleBaseNameA
EnumProcesses

Sections

.text
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 308KB - Virtual size: 304KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e0fbedb61f44b04c425dfb1f41f5789e

Headers

File Characteristics

Imports

kernel32

advapi32

shell32

psapi

Sections

.text Size: 44KB - Virtual size: 40KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 308KB - Virtual size: 304KB

.text
Size: 44KB - Virtual size: 40KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 308KB - Virtual size: 304KB