16186f7f4d5e0787101fc1eb64d59199_JaffaCakes118

General

Target

16186f7f4d5e0787101fc1eb64d59199_JaffaCakes118
Size

66KB
MD5

16186f7f4d5e0787101fc1eb64d59199
SHA1

f9a6deb616e0aa0988c8a388971eb5aa7232527a
SHA256

12c5d4d591a4577820e6d82da0cd9dbe56c5170bce173e424946ac5dfaae419f
SHA512

d7613c1958a268ca29e5c9c6f06a41a41bb68426e4d29a70593389d0690d42f3cac784fa336c4cdd711e2258d0992f888ced14caf67d05a6c05b190fb177543e
SSDEEP

1536:Fj2S7PS6e7Eh1uUHj4z+nnexsVjbwX/l0udL/6J:JVa6Z1QzMzVjbIlfV/I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16186f7f4d5e0787101fc1eb64d59199_JaffaCakes118

Files

16186f7f4d5e0787101fc1eb64d59199_JaffaCakes118
.exe windows:5 windows x86 arch:x86

59fb5276ded91afc8556144f1e82132a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersion
Sleep
FindFirstFileW
GetCurrentThreadId
FreeEnvironmentStringsA
CreateMutexW
OpenMutexW
GetCommandLineW
CreateDirectoryW
OpenMutexA
GetCommandLineA
InterlockedDecrement
ResumeThread
RtlUnwind
VirtualAlloc
ExitProcess
GetCPInfo
GetCurrentProcessId
IsBadReadPtr
GetOEMCP
GetModuleHandleW
DeleteFileA

msvcrt

__p__commode
_amsg_exit
__CxxFrameHandler
wcsncmp
__set_app_type
_wtoi
wcscpy
??0exception@@QAE@ABV0@@Z
_strdup
_purecall
isleadbyte
atoi
__p__fmode
strlen
__setusermatherr

ole32

IIDFromString
PropVariantClear
CreateDataAdviseHolder
CoGetMalloc
CoDisconnectObject
ReleaseStgMedium
GetHGlobalFromStream
StgOpenStorage
GetRunningObjectTable
StgCreateDocfileOnILockBytes
CoGetInterfaceAndReleaseStream
CoGetObjectContext
StringFromGUID2

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 15KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 490B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

59fb5276ded91afc8556144f1e82132a

Headers

File Characteristics

Imports

kernel32

msvcrt

ole32

Sections

.text Size: 11KB - Virtual size: 11KB

.rdata Size: 21KB - Virtual size: 21KB

.data Size: 15KB - Virtual size: 76KB

.idata Size: 16KB - Virtual size: 16KB

.reloc Size: 512B - Virtual size: 490B

.text
Size: 11KB - Virtual size: 11KB

.rdata
Size: 21KB - Virtual size: 21KB

.data
Size: 15KB - Virtual size: 76KB

.idata
Size: 16KB - Virtual size: 16KB

.reloc
Size: 512B - Virtual size: 490B