ebba88bd8ab10400f0ee1dd8b2d524b7_JaffaCakes118

General

Target

ebba88bd8ab10400f0ee1dd8b2d524b7_JaffaCakes118
Size

144KB
MD5

ebba88bd8ab10400f0ee1dd8b2d524b7
SHA1

76051f7794b1a1182cdecb4d88ccf0bb87fcfff5
SHA256

a59d171a398ab72fec4ef5a8dab55e0a48df5b899da3140fc8314320cd1364a2
SHA512

96d43964773c0e271a1eeac969015d4b39935036b4e055fea33170b4066bbef1ca4df2802511743ec0702d5a3678a49a2e93bd2b1fb9ddfa1c6e01912020222b
SSDEEP

3072:YhU2EGeuXfRwn8NnID16JAALSvhIVh31LIkFETk5e2bger:zfYRm8NIBSAVI5QCeg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ebba88bd8ab10400f0ee1dd8b2d524b7_JaffaCakes118

Files

ebba88bd8ab10400f0ee1dd8b2d524b7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dbc13ef2a4e16cea80556b3aa00ed651

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\asus\ylajy.pdb

Imports

kernel32

GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
CreateDirectoryW
CopyFileW
ResetEvent
VirtualFree
VirtualAlloc
SetTapePosition
lstrcmpiW
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
HeapSize
VirtualQuery
InterlockedExchange
RtlUnwind
IsBadWritePtr
HeapReAlloc
HeapAlloc
LoadLibraryA
HeapFree
HeapCreate
HeapDestroy
GetStartupInfoA
GetModuleHandleA
GetStartupInfoW
GetVersionExA
ExitProcess
GetProcAddress
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetLastError
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetSystemTimeAsFileTime

winspool.drv

DocumentPropertiesW
ClosePrinter
EnumPrintersW
OpenPrinterW

userenv

UnloadUserProfile
DestroyEnvironmentBlock
CreateEnvironmentBlock

winmm

timeBeginPeriod
timeEndPeriod
waveOutWrite
waveOutUnprepareHeader
waveOutClose
waveOutOpen

Sections

.text
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 775KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dbc13ef2a4e16cea80556b3aa00ed651

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

winspool.drv

userenv

winmm

Sections

.text Size: 48KB - Virtual size: 45KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 64KB - Virtual size: 775KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 48KB - Virtual size: 45KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 64KB - Virtual size: 775KB

.rsrc
Size: 4KB - Virtual size: 3KB