0404e1f000922b7ea7d8db5771f2d210_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0404e1f000922b7ea7d8db5771f2d210_JaffaCakes118
Size

145KB
MD5

0404e1f000922b7ea7d8db5771f2d210
SHA1

7dd3f9fe3c637b68f40953574e2112f0518e86a4
SHA256

dc968339fb0c1487ae47daa5bd52bb415578d76091233ab4be5a4c8a119e1aa4
SHA512

d886a0aae41083eaaf5b0d1976d779b4b35b1bd802932fec1f07106225983ebe67fe5d9813e608434328695b89478054a5219313dae9329c842a6e68910cd753
SSDEEP

1536:JPcwNt+GLqJKMop7M5RgZKZPpzxQoBaFJ4ibqPz6Uw3N:JHudJK1p7YqNJrqbZw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0404e1f000922b7ea7d8db5771f2d210_JaffaCakes118

Files

0404e1f000922b7ea7d8db5771f2d210_JaffaCakes118
.dll windows:4 windows x86 arch:x86

1a20df619ce870c9cd1b8ffc1c5bc103

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

case0information.pdb

Imports

kernel32

GetFileAttributesW
LocalReAlloc
_lopen
GlobalUnfix
SetThreadPriority
LocalShrink
ReadConsoleA
FoldStringA
TlsGetValue
GetHandleInformation
GetBinaryTypeA
GetTapeParameters
SwitchToFiber
GetFileTime
SetConsoleWindowInfo
ProcessIdToSessionId
EnumSystemLanguageGroupsW
_lwrite
UnmapViewOfFile
TlsSetValue
RemoveDirectoryA
VirtualAlloc
QueueUserWorkItem
_lread
WriteProfileSectionW
IsProcessorFeaturePresent
EnumSystemCodePagesW
GetLargestConsoleWindowSize
GetProcessHeap
GetProcessIoCounters
WriteConsoleOutputCharacterA
SetHandleCount
MoveFileExA
SetEvent
GetMailslotInfo
GlobalFree
SetInformationJobObject
BindIoCompletionCallback
PrepareTape
GetCalendarInfoW
GetCurrencyFormatW
EnumCalendarInfoW
CompareFileTime
FindVolumeMountPointClose
lstrcpyA
GetProfileSectionW
FillConsoleOutputCharacterW
CreateThread
SetCurrentDirectoryA
FindNextVolumeMountPointA
CreateSemaphoreA
SleepEx
AssignProcessToJobObject
lstrcmpW
WriteFileGather
OpenProcess
GetWindowsDirectoryA
SetComputerNameExA
GlobalFlags
lstrcatA
ExpandEnvironmentStringsW
GetLocaleInfoW
CloseHandle
LocalFlags
lstrlenA
GetTickCount
QueueUserWorkItem

msvcrt

memcpy
strlen

advapi32

FindFirstFreeAce
InitiateSystemShutdownExW
CreatePrivateObjectSecurityEx
CryptDeriveKey

Exports

Exports

IterationLosslessKeyboard
IterationSambaSyntax
IterationSpriteWord

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata0
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1a20df619ce870c9cd1b8ffc1c5bc103

Headers

File Characteristics

PDB Paths

Imports

kernel32

msvcrt

advapi32

Exports

Exports

Sections

.text Size: 39KB - Virtual size: 38KB

.data Size: 10KB - Virtual size: 9KB

.idata Size: 3KB - Virtual size: 2KB

.edata Size: 2KB - Virtual size: 2KB

.idata0 Size: 88KB - Virtual size: 88KB

.reloc Size: 1024B - Virtual size: 36KB

.text
Size: 39KB - Virtual size: 38KB

.data
Size: 10KB - Virtual size: 9KB

.idata
Size: 3KB - Virtual size: 2KB

.edata
Size: 2KB - Virtual size: 2KB

.idata0
Size: 88KB - Virtual size: 88KB

.reloc
Size: 1024B - Virtual size: 36KB