e1b50a052dbbf274df10907c3314a7d6_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

e1b50a052dbbf274df10907c3314a7d6_JaffaCakes118
Size

86KB
MD5

e1b50a052dbbf274df10907c3314a7d6
SHA1

694c7d7f9dff655eaeeb32999d2d66708995848f
SHA256

8ba5455e465816ea4ac1c0f588171bf459ab9a83b33cd0a653d1c79a227feaad
SHA512

079043a0e99c34c89bc0e82ed238b60a1665141d64847bcff9c63d09296be115565fbeca26ea0eeaeea468e920a0c1ee3538da60484df28e3622bd2858bca690
SSDEEP

1536:eoNWm7yOi0F0321iQdooGfiiQbVM7BHXHE3FlkijImyx+gmVwe:eK7Z03oVxbMcjTE+Fwe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e1b50a052dbbf274df10907c3314a7d6_JaffaCakes118

Files

e1b50a052dbbf274df10907c3314a7d6_JaffaCakes118
.exe windows:5 windows x86 arch:x86

182e3bab9ffdad764ca965a7b801aef5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrToIntExW
StrRChrW
StrCmpNW
StrChrW

ntdll

RtlNtStatusToDosError
_aulldiv
RtlUnwind

kernel32

UnmapViewOfFile
HeapAlloc
InterlockedIncrement
HeapFree
lstrlenW
GetLastError
lstrcpyW
GetModuleHandleW
GetProcessHeap
GetCommandLineA
CreateFileA
DeleteFileW
SetStdHandle
WriteConsoleW
GetSystemTimeAsFileTime
Sleep
WideCharToMultiByte
MultiByteToWideChar
GetDriveTypeW
GetLogicalDriveStringsW
QueryPerformanceCounter
GetFileAttributesW
QueryDosDeviceW
SetFileAttributesW
GetFileSize
SetFilePointer
MapViewOfFile
WriteFile
GetModuleFileNameW
CreateFileW
GetProcAddress
CreateFileMappingW
GetModuleHandleA
GetCurrentThreadId
CloseHandle
FindFirstFileW
InterlockedDecrement
WaitForSingleObject
SetEvent
InitializeCriticalSection
CreateEventA
LeaveCriticalSection
GetCurrentDirectoryW
EnterCriticalSection
FindClose
ResetEvent
WaitForMultipleObjects
FindNextFileW
DeleteCriticalSection
CreateThread
GetVersionExA
GetConsoleOutputCP
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapDestroy
HeapCreate
VirtualFree
GetTickCount
GetCurrentProcessId
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
LoadLibraryA
VirtualAlloc
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSize
WriteConsoleA
TerminateProcess

mpr

WNetGetUniversalNameW

Sections

.text
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

182e3bab9ffdad764ca965a7b801aef5

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

ntdll

kernel32

mpr

Sections

.text Size: 54KB - Virtual size: 54KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 12KB

.bss Size: 16KB - Virtual size: 16KB

.rsrc Size: 512B - Virtual size: 448B

.text
Size: 54KB - Virtual size: 54KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 12KB

.bss
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 512B - Virtual size: 448B