08570dc4e1932e96df2646d66c1e1200_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

08570dc4e1932e96df2646d66c1e1200_JaffaCakes118
Size

201KB
MD5

08570dc4e1932e96df2646d66c1e1200
SHA1

bacd1cbdf28c5d9a1e69ee8f0d1aaf7c4d697f2c
SHA256

e49019ff9d294d004e9f1b8b5d11b6a9e1a8d5ddd1959ab0f3eee54204735afd
SHA512

65b001923ff16bfd70643e4ed769bde13949ed5a1606b991e7de5f3bc708474d55a872ebdb363d4ec7a3694b988a2258f017ae2c0caa1b8042e984c62920cb86
SSDEEP

6144:3TCDJoGYBuO52+MHOmYi0RILlaz4xalPh:3TCSU22KmYi0I5a4UPh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
08570dc4e1932e96df2646d66c1e1200_JaffaCakes118

Files

08570dc4e1932e96df2646d66c1e1200_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8315aa18e518131e541e54f9bee31e1b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
VirtualAlloc
GetCurrentThreadId
GetProcessHeap
GetCurrentProcess
LoadLibraryA
GetCurrentProcessId
LoadLibraryW
InterlockedCompareExchange
GetVersionExA
GetModuleHandleA
GetCommandLineW
InterlockedIncrement
SetLastError
ExitProcess
GetStartupInfoW
ReadFile
GetModuleHandleW
FreeLibrary
HeapAlloc
GetCommandLineW
ExitProcess
GetStartupInfoW
GetEnvironmentVariableA
GetCurrentProcessId
lstrcmpW
VirtualFree
DisableThreadLibraryCalls
GetTempPathW
GetModuleHandleW
GetCurrentProcess
VirtualAlloc

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoA

ntdll

NtSetValueKey
RtlNewSecurityObject
RtlPrefixUnicodeString
NtCreateEvent
RtlCopyLuid
RtlInitializeGenericTable
NlsMbCodePageTag
NtOpenDirectoryObject
NtDelayExecution

gdi32

PtVisible
Rectangle
GetBitmapBits
GetDIBColorTable
CreateEllipticRgn
SetBkColor
GetLayout
IntersectClipRect
CreateRectRgn
EnumMetaFile
Rectangle
TranslateCharsetInfo
CreateRectRgnIndirect
GetDIBits

msvcrt

wcscat
_ftol
_vsnwprintf
_adjust_fdiv
__dllonexit
_controlfp
wcsrchr
wcslen
swprintf
malloc
_onexit

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 85KB - Virtual size: 467KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 81KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8315aa18e518131e541e54f9bee31e1b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

version

ntdll

gdi32

msvcrt

Sections

.text Size: 10KB - Virtual size: 10KB

.data Size: 8KB - Virtual size: 15KB

.rdata Size: 85KB - Virtual size: 467KB

.idata Size: 81KB - Virtual size: 99KB

.rsrc Size: 16KB - Virtual size: 16KB

.text
Size: 10KB - Virtual size: 10KB

.data
Size: 8KB - Virtual size: 15KB

.rdata
Size: 85KB - Virtual size: 467KB

.idata
Size: 81KB - Virtual size: 99KB

.rsrc
Size: 16KB - Virtual size: 16KB