306c6d3f96489eb09463f7cd26918290_JaffaCakes118

General

Target

306c6d3f96489eb09463f7cd26918290_JaffaCakes118
Size

196KB
MD5

306c6d3f96489eb09463f7cd26918290
SHA1

e248d332341602666c606d571c9879660469068d
SHA256

752b0dbc80664f1283aaa26947b59092dc6cfb045205393c76ee47ac282e70b2
SHA512

3cedcd51d44f1e44dd346ca2e158a6b9a887634f8f4819416cd3537371112f9b1ca2679cbfd5a650671bc96824fe86a3ee8c27eb845c4f0ee95750658a6d6702
SSDEEP

3072:wP19JdWYb2yXqJM4OJhI17U8Oeo+luPqIa2zbxHns0glNlyVoCImTtPdUxQ:E19Vb2GqEa7ro+SHzlqXlyVoZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
306c6d3f96489eb09463f7cd26918290_JaffaCakes118

Files

306c6d3f96489eb09463f7cd26918290_JaffaCakes118
.dll windows:4 windows x86 arch:x86

38898707e4cd7bc372fe912936b6ef90

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
lstrcpyA
GetModuleFileNameA
GetProfileStringA
FreeLibrary
GetProcAddress
lstrcatA
SetErrorMode
lstrlenA
IsDBCSLeadByte
lstrcmpA
lstrcmpiA

user32

OemToCharA
LoadStringA
CharLowerA
CharNextA
wsprintfA

msvcrt

_splitpath
isprint
atof
_makepath
_fullpath
memcpy
memmove
??2@YAPAXI@Z
atoi
sprintf
_adjust_fdiv
wcstombs
strchr
mbstowcs
_initterm
??3@YAXPAX@Z
free
malloc

Exports

Exports

InitPerThread
IsThreadSafe
UXFDecodeFormatOptions
UXFEncodeFormatOptions
UXFEndJob
UXFFreeFormatOptions
UXFGetContentType
UXFGetErrorText
UXFGetExportFormats
UXFGetPageN
UXFGetVersion
UXFInitExportFormat
UXFInitialize
UXFProcessRecord
UXFStartJob
UXFTermExportFormat
UXFTerminate
UninitPerThread

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 172KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 506B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

38898707e4cd7bc372fe912936b6ef90

Headers

File Characteristics

Imports

kernel32

user32

msvcrt

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 5KB

.rdata Size: 4KB - Virtual size: 1KB

.data Size: 172KB - Virtual size: 168KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 506B

.text
Size: 8KB - Virtual size: 5KB

.rdata
Size: 4KB - Virtual size: 1KB

.data
Size: 172KB - Virtual size: 168KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 506B