d755e52ba5658a639c778c22d1a906a3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d755e52ba5658a639c778c22d1a906a3_JaffaCakes118
Size

1.1MB
MD5

d755e52ba5658a639c778c22d1a906a3
SHA1

9be3800b49e84e0c014852977557f21bcde2a775
SHA256

61dd8b60ac35e91771d9ed4f337cd63e0aa6d0a0c5a17bb28cac59b3c21c24a9
SHA512

b0b1abcefdf7244dbb9d3c78f63cf8172d36198697483c16949afd0a7dbecc1db4656d5966e673b587269674d8408bc755998b9d3bb89ba35e5f4886ca2d89d9
SSDEEP

24576:AJTHRQs7nYLcC8F0aegtbXmTlKAgKk60E2hGe:AJmsELc3FfQSdJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d755e52ba5658a639c778c22d1a906a3_JaffaCakes118

Files

d755e52ba5658a639c778c22d1a906a3_JaffaCakes118
.exe windows:5 windows x86 arch:x86

3f5697fce2b5477c9a7e7bee5a88f3d3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

secur32

LsaEnumerateLogonSessions

kernel32

GetEnvironmentVariableA
CreateDirectoryA
MoveFileA
DeleteFileA
GetProcAddress
GetModuleHandleA
OutputDebugStringA
GetProcessHeap
FlushFileBuffers
CloseHandle
CreateFileW
HeapSize
HeapReAlloc
GetStringTypeW
LCMapStringW
MultiByteToWideChar
WriteConsoleW
SetStdHandle
RtlUnwind
HeapAlloc
FreeEnvironmentStringsW
GetLastError
HeapFree
GetCommandLineA
HeapSetInformation
GetStartupInfoW
IsProcessorFeaturePresent
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
GetCurrentProcess
HeapCreate
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
VirtualQuery
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
LoadLibraryW

user32

GetMessageW
RegisterClassExA
LoadCursorW
TranslateMessage
LoadIconW
DestroyWindow
MessageBoxA
UnregisterClassA
CreateWindowExA
FindWindowA
DefWindowProcW
DispatchMessageW
GetWindowTextA

advapi32

GetUserNameA

crypt32

CryptStringToBinaryA

Sections

.text
Size: 984KB - Virtual size: 984KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 46KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3f5697fce2b5477c9a7e7bee5a88f3d3

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

user32

advapi32

crypt32

Sections

.text Size: 984KB - Virtual size: 984KB

.rdata Size: 52KB - Virtual size: 52KB

.data Size: 46KB - Virtual size: 53KB

.rsrc Size: 15KB - Virtual size: 15KB

.text
Size: 984KB - Virtual size: 984KB

.rdata
Size: 52KB - Virtual size: 52KB

.data
Size: 46KB - Virtual size: 53KB

.rsrc
Size: 15KB - Virtual size: 15KB