38b30428d720df79f5516fdad7256a52_JaffaCakes118

General

Target

38b30428d720df79f5516fdad7256a52_JaffaCakes118
Size

116KB
MD5

38b30428d720df79f5516fdad7256a52
SHA1

2aa2718f8f428d99d8a46874d45d2365ba398e43
SHA256

bb213076fdf1dd6d79007bd594fede3e1e145e9c758a7a618bf1378349aabfb5
SHA512

c65b74169106be0f71a598130ec693aa5711c99d6239d56a275b7eda384a356c94f32d8ccb5ac5e2969f03d03bdd5f38fcdabc07674e089328fde3a7f310c89a
SSDEEP

1536:fR0s6X3gyHxCpFoGpd0lA4EnbyzpRHk0wPkKf+7hikvlXBI/CXsIyd3B:CngyHxCpbzTlwVowFik49xB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
38b30428d720df79f5516fdad7256a52_JaffaCakes118

Files

38b30428d720df79f5516fdad7256a52_JaffaCakes118
.dll windows:4 windows x86 arch:x86

9f24f444812b4e5d0e905cbfec36e3a2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
GetLocaleInfoW
SetEnvironmentVariableA
GetLocaleInfoA
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
RtlUnwind
SetStdHandle
LoadLibraryA
GetProcAddress
HeapReAlloc
VirtualAlloc
GetOEMCP
GetACP
GetCPInfo
UnhandledExceptionFilter
HeapAlloc
FatalAppExitA
InitializeCriticalSection
InterlockedIncrement
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
SetFilePointer
HeapFree
VirtualFree
HeapCreate
HeapDestroy
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetCurrentThread
TlsGetValue
GetCurrentProcess
TerminateProcess
ExitProcess
GetCommandLineA
EnumSystemLocalesA
GetUserDefaultLCID
GetTimeZoneInformation
CompareStringA
CompareStringW
GetLocalTime
WriteFile
GetTempPathA
WaitForMultipleObjects
OpenEventA
WaitForSingleObject
SetEvent
ResetEvent
ReleaseMutex
UnmapViewOfFile
IsBadWritePtr
GetModuleFileNameA
GlobalAlloc
GlobalLock
GlobalHandle
GlobalUnlock
GlobalFree
IsBadReadPtr
GetVersion
CreateProcessA
GetVersionExA
OpenMutexA
Sleep
CloseHandle

user32

GetSystemMetrics
FindWindowA
LoadImageA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

Exports

Exports

ruusiXLCq

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 100KB - Virtual size: 419KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9f24f444812b4e5d0e905cbfec36e3a2

Headers

File Characteristics

Imports

kernel32

user32

version

Exports

Exports

Sections

.text Size: 13KB - Virtual size: 12KB

.data Size: 100KB - Virtual size: 419KB

.rsrc Size: 1024B - Virtual size: 928B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 13KB - Virtual size: 12KB

.data
Size: 100KB - Virtual size: 419KB

.rsrc
Size: 1024B - Virtual size: 928B

.reloc
Size: 1KB - Virtual size: 1KB