eb2b443a76a6af4849469ba667daaa76_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

eb2b443a76a6af4849469ba667daaa76_JaffaCakes118
Size

82KB
MD5

eb2b443a76a6af4849469ba667daaa76
SHA1

18e663e5ebdb959205ebed4bf4940c0d91632520
SHA256

19aa1d22b630df1d6a4117b39afa2ebb1480f285a6c1e9cd8ccae16282eb7f15
SHA512

e3aa571438652e262a9c27810aac70b98fdbe901c21d156ecb6b46888b10fb7ec1ba84686010db34749787b02696a3def31b238cf329185e32b265f8547cee1b
SSDEEP

1536:eaNYjgIgYXI9ik/CXPoMat0pumRGJSCO3PCuFlfC8DSEsAHaUgVHNzhfR65bMJY:eqYjgoI91aXPoMFQmwkCO/CSlfC8DSlM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb2b443a76a6af4849469ba667daaa76_JaffaCakes118

Files

eb2b443a76a6af4849469ba667daaa76_JaffaCakes118
.exe windows:5 windows x86 arch:x86

5dc83898c267842551cf41ab1c10f6ee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
DeleteVolumeMountPointW
LoadLibraryA
HeapCreate
CreateActCtxA
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetUserDefaultLangID
GetCompressedFileSizeA
GetTickCount
FillConsoleOutputCharacterW
GlobalMemoryStatusEx
lstrcmpA
GetCurrentProcessId
SetConsoleInputExeNameW
GetProcessIoCounters
SetProcessShutdownParameters
GetStartupInfoA
GetStringTypeExA
GetCurrentThreadId
WaitCommEvent
GetCurrencyFormatW
EnumResourceLanguagesW

user32

GetLayeredWindowAttributes
GetMessageTime
SetParent
DdeAddData
GetWindowModuleFileNameA
CreateDialogIndirectParamAorW
MenuWindowProcW
DragObject
EnumPropsExW
SetCursorPos
WinHelpW
GetRawInputData
SetMenu
MenuWindowProcA
GetDialogBaseUnits
RegisterSystemThread
DlgDirSelectExW

msvcrt40

?sh_write@filebuf@@2HB
_filelengthi64
_wenviron
wcscspn
__pxcptinfoptrs
_wexeclpe
?ebuf@streambuf@@IBEPADXZ
_heapmin
?rdbuf@stdiostream@@QBEPAVstdiobuf@@XZ
malloc
??_Difstream@@QAEXXZ
??0fstream@@QAE@ABV0@@Z
strpbrk
_local_unwind2
_chmod
??4strstreambuf@@QAEAAV0@ABV0@@Z
_wunlink
_safe_fprem

olecli32

PbCreateFromFile
OleEnumObjects
DefCreateFromFile
OleQueryLinkFromClip
GenEqual
OleCreateFromFile
DibEnumFormat
OleQueryBounds
ErrObjectLong
OleClose
LeActivate
MfSaveToStream
LeQueryBounds
DibSaveToStream
GenChangeData
OleRename

rpcrt4

I_RpcTransDatagramFree
NdrGetSimpleTypeBufferAlignment
NdrFixedArrayMemorySize
NdrConformantVaryingStructMarshall
NdrRpcSmClientFree
RpcBindingInqAuthClientW
RpcBindingToStringBindingW
I_RpcPauseExecution
RpcServerRegisterIf
RpcStringFreeA
RpcFreeAuthorizationContext
MesIncrementalHandleReset
RpcServerUseProtseqW
TowerConstruct
SimpleTypeMemorySize
NdrXmitOrRepAsFree
UuidToStringA
RpcStringBindingComposeW
NdrConformantStructFree
NdrRangeUnmarshall
CStdStubBuffer_IsIIDSupported
RpcServerUseAllProtseqsEx
NdrNonEncapsulatedUnionBufferSize
NdrServerUnmarshall

crtdll

sin
_execv
_y0
_mbsnextc
_iob
getchar
_environ_dll
_fstat
free
strcoll

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5dc83898c267842551cf41ab1c10f6ee

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcrt40

olecli32

rpcrt4

crtdll

Sections

.text Size: 30KB - Virtual size: 29KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 17KB - Virtual size: 60KB

.rsrc Size: 19KB - Virtual size: 19KB

.reloc Size: 512B - Virtual size: 236B

.text
Size: 30KB - Virtual size: 29KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 17KB - Virtual size: 60KB

.rsrc
Size: 19KB - Virtual size: 19KB

.reloc
Size: 512B - Virtual size: 236B