d4ecf352a0e17202d9738c843fe77898_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

d4ecf352a0e17202d9738c843fe77898_JaffaCakes118
Size

324KB
MD5

d4ecf352a0e17202d9738c843fe77898
SHA1

94f964f3ecc7eb860de1940b64ab4f13f151d510
SHA256

16cbf72efc6847de1cffab0afed34e3967a9c1bf94f0936aefc728513f7d2c0c
SHA512

bebade0a93524b3ce03197e0527ba76b9d29a864567f5b32a867aff457af41ebd9b7fbf6a78d2638869f6f0c09ebf28991b5ff5f0e7e790312174c424d7a4a64
SSDEEP

6144:KxulkMFCZFgrCufWzrf6LqHqipTXBZEWbLI2GQP1S0sXEQ97xeh8PR:5vCbgFO/6LqHRpj542nQ0sUK9S8Z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d4ecf352a0e17202d9738c843fe77898_JaffaCakes118

Files

d4ecf352a0e17202d9738c843fe77898_JaffaCakes118
.exe windows:5 windows x86 arch:x86

792470d35722802e9f94e34550e113f6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtAllocateVirtualMemory
RtlAddAccessAllowedAce
RtlAdjustPrivilege

kernel32

EnterCriticalSection
GetLastError
GetModuleFileNameW
GetStartupInfoA
lstrcmpiW
lstrcatW
LeaveCriticalSection
DisableThreadLibraryCalls
FindResourceW
HeapDestroy
lstrlenA
lstrcpynW
FreeLibrary
lstrlenW
MultiByteToWideChar
InitializeCriticalSection
SizeofResource
InterlockedIncrement
lstrcpyW
LoadLibraryExW
DeleteCriticalSection
LoadResource

msvcrt

__CxxFrameHandler
_purecall
wcsncat
realloc
_initterm
wcscpy
malloc
wcsncpy
wcslen
free
_adjust_fdiv
_except_handler3

ole32

CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc

oleaut32

VariantClear

advapi32

RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegSetValueExW
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegQueryValueExW

rpcrt4

RpcStringFreeW

user32

CharNextW

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 298KB - Virtual size: 298KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

792470d35722802e9f94e34550e113f6

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

msvcrt

ole32

oleaut32

advapi32

rpcrt4

user32

Sections

.text Size: 9KB - Virtual size: 8KB

.rsrc Size: 12KB - Virtual size: 11KB

.data Size: 3KB - Virtual size: 1.4MB

.rdata Size: 298KB - Virtual size: 298KB

.tls Size: 512B - Virtual size: 4KB

.text
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 12KB - Virtual size: 11KB

.data
Size: 3KB - Virtual size: 1.4MB

.rdata
Size: 298KB - Virtual size: 298KB

.tls
Size: 512B - Virtual size: 4KB