d49d899db62c8d40771401becdc0a0bb_JaffaCakes118

General

Target

d49d899db62c8d40771401becdc0a0bb_JaffaCakes118
Size

172KB
MD5

d49d899db62c8d40771401becdc0a0bb
SHA1

ffd6acd61a8b8147cff99d1f006b3190b57a7d6a
SHA256

610355bd033fcd5718a4b56d5a95d245d4c58f6e25443e31436b4677fd7dad44
SHA512

c2a86bd4b7a74823c270f44ec12cff634df48fcc7d311d86e085f4b7c25862c6141d6d1929b2d9113f6ac157097f6b53575ba85f8e47d33a8306daf36a909d86
SSDEEP

3072:nDuXhxxVmuuIFmF2COmJ4BLRsCYUixi1HVRMGRVFhnE7QcTSRxb:nqXyp4TCOrZZYUixi1ffhnE7QPR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d49d899db62c8d40771401becdc0a0bb_JaffaCakes118

Files

d49d899db62c8d40771401becdc0a0bb_JaffaCakes118
.exe .ps1 windows:4 windows x86 arch:x86 polyglot

486f654c97dd361a563dde6e3f3e4f57

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Egypyky\Vozow\Sodysoh\ago\Das\etibaf.pdb

Imports

kernel32

LoadLibraryW
ExitProcess
GetFileTime
GetModuleFileNameW
FindClose
FindNextFileW
FindFirstFileW
TlsGetValue
TlsAlloc
GetProfileStringW
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
HeapSize
VirtualQuery
InterlockedExchange
RtlUnwind
LoadLibraryA
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
HeapFree
HeapAlloc
GetModuleHandleA
GetStartupInfoW
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
GetProcAddress
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetLastError
GetSystemTimeAsFileTime

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

userenv

UnloadUserProfile
DestroyEnvironmentBlock
CreateEnvironmentBlock

winmm

timeBeginPeriod
timeEndPeriod
waveOutRestart
waveOutPrepareHeader
waveOutClose
waveOutOpen

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 628KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

486f654c97dd361a563dde6e3f3e4f57

Headers

File Characteristics

PDB Paths

Imports

kernel32

winspool.drv

userenv

winmm

Sections

.text Size: 40KB - Virtual size: 38KB

.rdata Size: 72KB - Virtual size: 68KB

.data Size: 52KB - Virtual size: 628KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 40KB - Virtual size: 38KB

.rdata
Size: 72KB - Virtual size: 68KB

.data
Size: 52KB - Virtual size: 628KB

.rsrc
Size: 4KB - Virtual size: 3KB