2cc11621974913ebd25c8d9ec7b202f6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2cc11621974913ebd25c8d9ec7b202f6_JaffaCakes118
Size

68KB
MD5

2cc11621974913ebd25c8d9ec7b202f6
SHA1

6820112a21298d13270a60492769fd2686814863
SHA256

bcb065b7af14b16d2c55436210b709f4254b38e85ae409af7a196788f8fa580a
SHA512

25b89ed536c2b586f4b2bdd44fbe2c27145596e4421a6a80600917bb55296424fed3dba45e6d66f11e452fafac1baf88f902879b20d5ac7d5be074294abc9d12
SSDEEP

768:m6/Hj39on6RVFHEONthMLt3lmQoJLlyVYT8YGmQoJLlyVYT8YrT:mSHj3+6RAOJst4FL4VwBFL4Vwl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2cc11621974913ebd25c8d9ec7b202f6_JaffaCakes118

Files

2cc11621974913ebd25c8d9ec7b202f6_JaffaCakes118
.exe windows:5 windows x86 arch:x86

710709cdfc779fd4ea55ba764847550f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Projekte\Stub\Release\Stub.pdb

Imports

kernel32

LoadLibraryA
GetProcAddress
FindResourceA
LoadResource
LockResource
SizeofResource
GetModuleFileNameA
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DecodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EncodePointer
GetStartupInfoW
HeapSetInformation
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime

msvcp100

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z

msvcr100

_configthreadlocale
__setusermatherr
exit
_fmode
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_initterm_e
_controlfp_s
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
memmove
??2@YAPAXI@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
??3@YAXPAX@Z
_initterm
_invoke_watson
_acmdln
_commode
memcpy
memset
_CxxThrowException
__CxxFrameHandler3

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 726B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

710709cdfc779fd4ea55ba764847550f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcp100

msvcr100

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 57KB - Virtual size: 56KB

.reloc Size: 1024B - Virtual size: 726B

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 57KB - Virtual size: 56KB

.reloc
Size: 1024B - Virtual size: 726B