fab8d545f9d0069f1095d4c255fc7c94_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

fab8d545f9d0069f1095d4c255fc7c94_JaffaCakes118
Size

669KB
MD5

fab8d545f9d0069f1095d4c255fc7c94
SHA1

8f7ae4957c28f718c3def7c78fe52824c2870ad2
SHA256

d4eaff6dd12f0f387f370a14181bd36e5fe43516ccda05ebc204e77050ec7880
SHA512

2631fd9d398999e8e42184a2097280b223fa079bde271cb7dc451b52bcd7991659f65211a2991f4e1e3513f7ea8c4876199909f4d4001ac30ca5863d8a318ca3
SSDEEP

12288:P5yYLWD0I9D66KcddYyQ9vw91Dm9glv3wXf2EG7A0diw5s1E7/c6saYeqQcY:ET0IgpcdZ8vUDLlTc67/c6+V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fab8d545f9d0069f1095d4c255fc7c94_JaffaCakes118

Files

fab8d545f9d0069f1095d4c255fc7c94_JaffaCakes118
.exe windows:5 windows x86 arch:x86

bec5279be0cb3c653f5b0b143b00a99c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vij susa wehajuxexowof\nad\vagobad\niceyekik.pdb

Imports

kernel32

GetThreadContext
SetInformationJobObject
lstrlenA
FindResourceExW
InterlockedDecrement
GetSystemWindowsDirectoryW
FreeEnvironmentStringsA
OutputDebugStringW
CreateNamedPipeW
GetPrivateProfileStringW
GetUserDefaultLangID
GetCommandLineA
GlobalAlloc
SetFileShortNameW
LoadLibraryW
FreeConsole
GetSystemWow64DirectoryW
InterlockedPopEntrySList
HeapDestroy
SetConsoleCursorPosition
GetModuleFileNameW
GetOverlappedResult
GetStartupInfoA
GetCPInfoExW
OpenMutexW
GetLastError
SetLastError
GetProcAddress
CreateNamedPipeA
MoveFileW
SetStdHandle
SearchPathA
VirtualAllocEx
GetProfileStringA
PostQueuedCompletionStatus
FindAtomA
SetSystemTime
GetModuleFileNameA
WriteProfileStringA
WTSGetActiveConsoleSessionId
HeapSetInformation
GetCurrentDirectoryA
ReadConsoleInputW
DeleteFileW
CloseHandle
CreateFileW
WideCharToMultiByte
GetCommandLineW
GetStartupInfoW
DecodePointer
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
InterlockedIncrement
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
GetCurrentThreadId
TlsFree
GetModuleHandleW
RtlUnwind
HeapValidate
IsBadReadPtr
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
ExitProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapCreate
WriteFile
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringA
WriteConsoleW
LCMapStringW
MultiByteToWideChar
GetStringTypeW
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapAlloc
HeapReAlloc
HeapSize
HeapQueryInformation
HeapFree
RaiseException
FlushFileBuffers

winhttp

WinHttpReadData

Sections

.text
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 498KB - Virtual size: 4.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bec5279be0cb3c653f5b0b143b00a99c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

winhttp

Sections

.text Size: 99KB - Virtual size: 99KB

.rdata Size: 32KB - Virtual size: 32KB

.data Size: 498KB - Virtual size: 4.7MB

.rsrc Size: 15KB - Virtual size: 14KB

.reloc Size: 23KB - Virtual size: 22KB

.text
Size: 99KB - Virtual size: 99KB

.rdata
Size: 32KB - Virtual size: 32KB

.data
Size: 498KB - Virtual size: 4.7MB

.rsrc
Size: 15KB - Virtual size: 14KB

.reloc
Size: 23KB - Virtual size: 22KB