e2798a0b8c2a7313f6a7718cb2f87fcc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e2798a0b8c2a7313f6a7718cb2f87fcc_JaffaCakes118
Size

6.3MB
MD5

e2798a0b8c2a7313f6a7718cb2f87fcc
SHA1

ca1ed8a94c9ed9d321b436ebde43115510a9a257
SHA256

78d5f796e937543688efb583848ee0285503992166d63a40d8244f6cafbd8d34
SHA512

b50dd57da4b705433348e547ab7bd1e1842e2b843c89d6670706981951f4b9721e9d79404567ef6085ca30e8606609bf531349a8421d8163f3bee66ab27c595e
SSDEEP

196608:jeE6jP8NC2ihIF0Tt6GAWsxxvOqUgCc6Sg:jeP0VihIatctxxTUg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e2798a0b8c2a7313f6a7718cb2f87fcc_JaffaCakes118

Files

e2798a0b8c2a7313f6a7718cb2f87fcc_JaffaCakes118
.dll windows:6 windows x86 arch:x86

881326ddcb1f8bddec4a049136c2bcb6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetWindowLongW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

gdi32

AddFontMemResourceEx

msvcp140

?_Xout_of_range@std@@YAXPBD@Z

vcruntime140

strstr

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-string-l1-1-0

isdigit

api-ms-win-crt-runtime-l1-1-0

_initterm

api-ms-win-crt-convert-l1-1-0

strtoul

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 8.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.8rF0
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.8rF1
Size: 6.3MB - Virtual size: 6.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

881326ddcb1f8bddec4a049136c2bcb6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

msvcp140

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

wtsapi32

Sections

.text Size: - Virtual size: 122KB

.rdata Size: - Virtual size: 135KB

.data Size: - Virtual size: 8.5MB

.8rF0 Size: - Virtual size: 1.1MB

.8rF1 Size: 6.3MB - Virtual size: 6.3MB

.reloc Size: 1024B - Virtual size: 744B

.text
Size: - Virtual size: 122KB

.rdata
Size: - Virtual size: 135KB

.data
Size: - Virtual size: 8.5MB

.8rF0
Size: - Virtual size: 1.1MB

.8rF1
Size: 6.3MB - Virtual size: 6.3MB

.reloc
Size: 1024B - Virtual size: 744B