14282a9e8f81d4ce929218f25f9b1c88_JaffaCakes118

General

Target

14282a9e8f81d4ce929218f25f9b1c88_JaffaCakes118
Size

891KB
MD5

14282a9e8f81d4ce929218f25f9b1c88
SHA1

335279a250786957ac0db53fd6e0e33bcf2f29af
SHA256

899927b90714a538412e904ead798769c2dc60e80bd4d55d0f6e9468553eabef
SHA512

88b2e53df349184330d01e936407d5c277d759808c396866afd0d9a79f7f061313ea3d2fd9fee88e19597c1e35cf52f273695719d8cf307210767f98a72e30b9
SSDEEP

24576:3Dm8M2WaLm2ae6HllFbwHrLki3RVaUKwxyq0d7:Tm8maa2ae8lFbYLkRRFd7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14282a9e8f81d4ce929218f25f9b1c88_JaffaCakes118

Files

14282a9e8f81d4ce929218f25f9b1c88_JaffaCakes118
.exe windows:6 windows x86 arch:x86

258a449b35c07e94d6ffbb9fdc15a840

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

MpPackageStub.pdb

Imports

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetCurrentProcess
ExitProcess
GetModuleHandleW
GetProcAddress
EnumResourceNamesW
FindResourceW
FreeLibrary
LoadResource
HeapAlloc
GetSystemWindowsDirectoryW
HeapFree
CreateDirectoryW
GetProcessHeap
WriteFile
LoadLibraryW
SizeofResource
CreateFileW
GetLastError
GetCurrentDirectoryW
LockResource
SetCurrentDirectoryW
RemoveDirectoryW
CloseHandle
DeleteFileW
SetFileAttributesW

advapi32

RegCloseKey
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW

ntdll

memset
DbgPrint
memcpy

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.7MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 402B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

258a449b35c07e94d6ffbb9fdc15a840

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

ntdll

Sections

.text Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 804B

.rsrc Size: 5.7MB - Virtual size: 5.7MB

.reloc Size: 512B - Virtual size: 402B

.text
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 804B

.rsrc
Size: 5.7MB - Virtual size: 5.7MB

.reloc
Size: 512B - Virtual size: 402B