e700eb4c6d47dc5ce4040e83f0105dd3_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

e700eb4c6d47dc5ce4040e83f0105dd3_JaffaCakes118
Size

220KB
MD5

e700eb4c6d47dc5ce4040e83f0105dd3
SHA1

514e644eb7de24f36a08e3a13a7df9937d3e6e19
SHA256

1a8b75020c3245b2a5621a51c2325e78f03f9c59810e2d263728109b96d8818f
SHA512

2eb38bbdacadcedd2ee1e674296f4542059b998ec2a1f11a4f0df4fb02c3d7fe938a17a26fbe2e02de2d2b93ad641e20fabf9891550bfe1ce250c12121027371
SSDEEP

3072:SX9eFa5RGDs82p8SUUy6wSxMPgj3QQbLFwRHTCxrXMzb7gwgAnZSxGSAJxRO:SXv5RGDs8w8215xKEFUHT8MH8wgL8fw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e700eb4c6d47dc5ce4040e83f0105dd3_JaffaCakes118

Files

e700eb4c6d47dc5ce4040e83f0105dd3_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b7d80dbc8cdbcd0c4e3ab7905b8ac28a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalUnlock
lstrlenA
WritePrivateProfileStructA
GetNumberOfConsoleInputEvents
FindResourceExW
CallNamedPipeA
LoadLibraryExW
ReadConsoleA
InterlockedDecrement
CompareFileTime
GetUserDefaultLCID
InterlockedCompareExchange
FreeEnvironmentStringsA
_lclose
SetTapeParameters
CreateNamedPipeW
GetSystemTimeAsFileTime
WriteFile
TlsSetValue
GlobalAlloc
LoadLibraryW
Sleep
GetVersionExW
DeleteVolumeMountPointW
WriteConsoleW
IsDBCSLeadByte
lstrcatA
SetThreadPriority
DisconnectNamedPipe
DeactivateActCtx
CreateJobObjectA
SetCurrentDirectoryA
GetLastError
GetProcAddress
BeginUpdateResourceW
SetVolumeLabelW
WriteProfileSectionA
IsValidCodePage
EnterCriticalSection
_hwrite
GetLocalTime
LoadLibraryA
LocalAlloc
WaitForMultipleObjects
GetPrivateProfileSectionNamesA
GetOEMCP
WaitCommEvent
GetCommTimeouts
RequestWakeupLatency
EnumDateFormatsW
OpenSemaphoreW
LocalSize
AreFileApisANSI
lstrcpyA
GetModuleHandleW
ExitProcess
GetCommandLineA
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetCPInfo
GetACP
HeapSize
RtlUnwind
GetLocaleInfoA
HeapAlloc
VirtualAlloc
HeapReAlloc
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
GetModuleHandleA
RaiseException

Exports

Exports

_geek@8
_gekelberifin@8

Sections

.text
Size: 190KB - Virtual size: 190KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 11.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b7d80dbc8cdbcd0c4e3ab7905b8ac28a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 190KB - Virtual size: 190KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 5KB - Virtual size: 11.4MB

.rsrc Size: 15KB - Virtual size: 14KB

.text
Size: 190KB - Virtual size: 190KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 5KB - Virtual size: 11.4MB

.rsrc
Size: 15KB - Virtual size: 14KB