2737ddbd643ea253bad5e393240f2f5c_JaffaCakes118

General

Target

2737ddbd643ea253bad5e393240f2f5c_JaffaCakes118
Size

158KB
MD5

2737ddbd643ea253bad5e393240f2f5c
SHA1

68d793720d5e8aa10104aa17e672a7e7756d0161
SHA256

dedf07af9e37872238a696437c329aca20a05e4e78f503317e66f6dd4609dd27
SHA512

7c4f49c7933d62683b5b1d6bc780f88733711f36a17d50a69ddc9b8f86e73bc76ecacf1d7cf0533b21e4cd13a69c2a9a293efce2b0d19ebc8de55bfd766247d0
SSDEEP

3072:rOE96PdsWKLT0Zm+MXFXZq2eJIgZQOm0ELMD6AgM8ezeyaciBIFhgYN0Fm9:rOEIPddKP+MXaJIsEA6AgM8ezdLN4Yq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2737ddbd643ea253bad5e393240f2f5c_JaffaCakes118

Files

2737ddbd643ea253bad5e393240f2f5c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

d661a4b463c37073f21f07ac48c31f45

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msi

ord60

user32

LoadCursorFromFileA
LoadIconA
LoadCursorA
SetWindowTextA

kernel32

GetLastError
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
GetUserDefaultLCID
EnumSystemLocalesA
GetStdHandle
GetCommandLineA
GetCommandLineW
GetModuleHandleA
VirtualAlloc
GetPriorityClass
GetTickCount
GetCurrentThread
GetVersionExA
GetStartupInfoA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetEnvironmentVariableA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
HeapReAlloc
IsBadWritePtr
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
Sleep
IsValidLocale
IsValidCodePage
GetLocaleInfoA

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 111KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d661a4b463c37073f21f07ac48c31f45

Headers

DLL Characteristics

File Characteristics

Imports

msi

user32

kernel32

Sections

.text Size: 39KB - Virtual size: 38KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 111KB - Virtual size: 194KB

.rsrc Size: 1024B - Virtual size: 648B

.text
Size: 39KB - Virtual size: 38KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 111KB - Virtual size: 194KB

.rsrc
Size: 1024B - Virtual size: 648B