17ef5be419e18d3e6c3d3fc1a57e9712_JaffaCakes118

General

Target

17ef5be419e18d3e6c3d3fc1a57e9712_JaffaCakes118
Size

810KB
MD5

17ef5be419e18d3e6c3d3fc1a57e9712
SHA1

fdbcf0580ea1385cd240f1b83d0c4766d4bbeba6
SHA256

4e8da2e1699941973485b152e5dbd34f828b139c5990a64ac1a7d4cbe910f415
SHA512

eb0a7a81aae7575493f360c5be9b33633a016b6bd714f69037d5336c06dd120c9fed312b3cd3225747cd5f0d6e11dd197d5292d06be7be2dd678ccc1fb6e470b
SSDEEP

12288:52RZBaAI+hpKZG6J7wJ3CKzqtXik2XPQ:5KHI+rP69EjXY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17ef5be419e18d3e6c3d3fc1a57e9712_JaffaCakes118

Files

17ef5be419e18d3e6c3d3fc1a57e9712_JaffaCakes118
.exe windows:5 windows x86 arch:x86

688ccf8ee60dbc6874a310613b42f88d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessA
DeleteCriticalSection
EnterCriticalSection
EnumSystemLocalesA
ExitProcess
FatalAppExitA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetACP
GetCPInfo
GetCommandLineA
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStrings
GetEnvironmentStringsW
GetFileType
GetLastError
GetLocaleInfoA
GetLocaleInfoW
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
GetUserDefaultLCID
GetVersion
GetVersionExA
HeapAlloc
HeapCreate
CompareStringW
HeapFree
HeapReAlloc
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
IsBadWritePtr
IsValidCodePage
IsValidLocale
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
OpenProcess
ReadProcessMemory
RtlUnwind
SetEnvironmentVariableA
SetHandleCount
SetLastError
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
WaitForSingleObject
WideCharToMultiByte
WriteFile
GetModuleHandleW
VirtualAllocEx
lstrlenW
CompareStringA
HeapDestroy
CloseHandle

user32

LoadIconW
LoadIconA

advapi32

RegOpenKeyA
RegQueryValueExA

Sections

.text
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 702KB - Virtual size: 702KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.40
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

688ccf8ee60dbc6874a310613b42f88d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

Sections

.text Size: 104KB - Virtual size: 103KB

.data Size: 702KB - Virtual size: 702KB

.40 Size: 512B - Virtual size: 276B

.rsrc Size: 3KB - Virtual size: 2KB

.text
Size: 104KB - Virtual size: 103KB

.data
Size: 702KB - Virtual size: 702KB

.40
Size: 512B - Virtual size: 276B

.rsrc
Size: 3KB - Virtual size: 2KB