11db6da7b5c3b2492d354f9fe91d3794_JaffaCakes118

General

Target

11db6da7b5c3b2492d354f9fe91d3794_JaffaCakes118
Size

201KB
MD5

11db6da7b5c3b2492d354f9fe91d3794
SHA1

3786f6f542a0e28145dce595793373a96db1a9ff
SHA256

04b9b64f2a823986ad24ee0051c165bc18a7ab6cb9f5027c7130cbc89f736332
SHA512

2757140a763e468c17fa13ff3cea43d7a7555cdd760190ccd3e650fde6c9f37d670bfdfbd7f9b80b635d677d4703110fc0b3f1624d587bf6d2f87ddf1497e5cd
SSDEEP

6144:I7z2DeEWX7Sk+OCdMO5+ZUtKue2K56T+r:I7z0GmRJdMkdtN16

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11db6da7b5c3b2492d354f9fe91d3794_JaffaCakes118

Files

11db6da7b5c3b2492d354f9fe91d3794_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a0f581b8f54779e63cde2af1449f177f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

QueryPerformanceCounter
GetFileAttributesA
Sleep
SetCurrentDirectoryA
VirtualFree
LocalAlloc
FileTimeToLocalFileTime
CreateFileMappingA
Module32First
SetEndOfFile
InitializeCriticalSection
GetOEMCP
CreateFileMappingA
CreateThread
SetLastError
GetFileType
GetEnvironmentStringsW
CompareStringA
SwitchToThread
OpenThread
GetTempFileNameA
RaiseException
CreateMutexA
EnterCriticalSection
DeleteCriticalSection
SetStdHandle
LCMapStringW
VirtualProtect
GetStdHandle
CloseHandle
RtlUnwind
CreateFileW
GetCurrentDirectoryA
IsValidCodePage
SetProcessAffinityMask

user32

LoadIconW
GetInputState
ToAscii
GetMenuState
CharLowerW
EnumChildWindows
SetForegroundWindow
GetKeyboardState
DrawFrameControl
EnableMenuItem
CreateCaret
SetWindowPlacement
DispatchMessageW
ArrangeIconicWindows
GetDC
GetDesktopWindow
HideCaret
DeferWindowPos
GetUpdateRgn
CreateMenu
GetKeyboardLayoutList
OpenInputDesktop
GetMenuItemID
PeekMessageW
CharLowerBuffW
IsChild
SetRectEmpty
DrawIconEx
SetActiveWindow
SetScrollRange
DestroyCaret
DefWindowProcW
MonitorFromPoint
TranslateMessage
ShowCaret

ntdll

NtQuerySystemInformation
NtWriteFile
NtQuerySection
ZwOpenFile

Sections

.text
Size: 154KB - Virtual size: 154KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a0f581b8f54779e63cde2af1449f177f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ntdll

Sections

.text Size: 154KB - Virtual size: 154KB

.data Size: 43KB - Virtual size: 43KB

.rsrc Size: 2KB - Virtual size: 4KB

.text
Size: 154KB - Virtual size: 154KB

.data
Size: 43KB - Virtual size: 43KB

.rsrc
Size: 2KB - Virtual size: 4KB