2e32794a2cf477774448b1258eedaacd_JaffaCakes118

General

Target

2e32794a2cf477774448b1258eedaacd_JaffaCakes118
Size

189KB
MD5

2e32794a2cf477774448b1258eedaacd
SHA1

06c9f4fd1785301916d9f5f8758f118fee366235
SHA256

e4e4e47a1969a9df134fbbdc4cacba805135aec52acb5f7e7da5262c4819ce39
SHA512

71df302afe38e2f15911e58f69874e3ad6fe4303bfe7dd42806dc40180e4363bd0f90c320dd6b65b71d00fa664dbe91e38caf4ac027a344e2b0f663f9eabe273
SSDEEP

3072:YgXqWm5hZGWl/6YOiUJbuJXMAto4QWOUW7CmsflmH5UgjqpOlu1dJS71qghyWt6:Ygnm5bjZUJeV9QWO9RiQvWwgdo1qghP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2e32794a2cf477774448b1258eedaacd_JaffaCakes118

Files

2e32794a2cf477774448b1258eedaacd_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ebfc16d64257218bc4e94e1169782c41

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

sql

IsamKillMsg
IsamSigMark
IsamSigInterrupt
IsamTmpPath
IsamModuleCheckOK
sql_basic_language
sql_read_language
TabulaMessageBox
HebrewFilter
sql_signal_remove_tmpfiles
sql_prep
sql_message
WinSandGlass
OraExit

user32

GetSystemMetrics
TranslateMessage
DispatchMessageA
RegisterClassA
CreateWindowExA
DefWindowProcA
PeekMessageA

msvcr80

strlen
getenv
vsprintf
__iob_func
fopen
getc
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
strcat
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
freopen
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
vfprintf
fclose
strcpy
sprintf
__argc
__argv
_fmode
exit
_crt_debugger_hook

kernel32

SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
InterlockedCompareExchange
Sleep
InterlockedExchange
GetVersion
UnhandledExceptionFilter

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 176KB - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ebfc16d64257218bc4e94e1169782c41

Headers

File Characteristics

Imports

sql

user32

msvcr80

kernel32

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 176KB - Virtual size: 179KB

.rsrc Size: 1024B - Virtual size: 664B

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 176KB - Virtual size: 179KB

.rsrc
Size: 1024B - Virtual size: 664B