00369c252d8108de42ebb38b1493f250_JaffaCakes118

General

Target

00369c252d8108de42ebb38b1493f250_JaffaCakes118
Size

2.5MB
MD5

00369c252d8108de42ebb38b1493f250
SHA1

16c580cd6583a8d0c565bd8159370185c74ba0ab
SHA256

8d6364b01e819ae7891229c2d00f2e8f80b10f47020a101ba578bfa7bb28dedf
SHA512

2cadd47cfb62cb9a2b8abf318d1feaff541b9e6083c09d7b7ce00054c0e5d6e457f2be4c1064356bd3c1455be3b22181fcb1df4398c7fa26764d5e4ae889d6c5
SSDEEP

24576:ZspiQJUyzmKwI+vYZ5S2fpIZ/HJc6tFotHwYLih:Z2synwIvvG98GY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00369c252d8108de42ebb38b1493f250_JaffaCakes118

Files

00369c252d8108de42ebb38b1493f250_JaffaCakes118
.exe windows:5 windows x86 arch:x86

9be7b4224ce440a12102f5c4e17b1e7a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

GetDeviceDriverFileNameW
GetModuleBaseNameW

shell32

DragFinish

kernel32

GetProcAddress
GlobalFree
VirtualAlloc
GetCurrentProcess
GetCurrentThreadId
GetLastError
GetLocalTime
LoadLibraryExW
GetModuleFileNameW
ExpandEnvironmentStringsW
GetVersionExW
GetACP
CompareStringW
GetModuleHandleA
GetStartupInfoW
GetVersion
ExitProcess
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentStrings
GetCommandLineW
GetCommandLineA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
HeapReAlloc
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetCPInfo
GetOEMCP

ole32

CreateStreamOnHGlobal
CoTaskMemAlloc

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 64.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.toour
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9be7b4224ce440a12102f5c4e17b1e7a

Headers

File Characteristics

Imports

psapi

shell32

kernel32

ole32

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.data Size: 12KB - Virtual size: 64.4MB

.idata Size: 2KB - Virtual size: 1KB

.toour Size: 1.4MB - Virtual size: 1.4MB

.rsrc Size: 15KB - Virtual size: 17KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: 12KB - Virtual size: 64.4MB

.idata
Size: 2KB - Virtual size: 1KB

.toour
Size: 1.4MB - Virtual size: 1.4MB

.rsrc
Size: 15KB - Virtual size: 17KB