418683bb308ef7e6281a3558378a05eb_JaffaCakes118

General

Target

418683bb308ef7e6281a3558378a05eb_JaffaCakes118
Size

94KB
MD5

418683bb308ef7e6281a3558378a05eb
SHA1

a926066c21ddf406ecceb47ba905916a899fd125
SHA256

19acda81cd56622ab3e2e1359035162821ce6ea7a8d48c123029db9ab28ae895
SHA512

28dbdbb38a08b26c9ce2cb501be41e9effc3445ba81a9058fd9d075ad6e6929e8df9cd00e218fe0ab1e09b194c171f94bea91105db3338cd452cbf5f82236b58
SSDEEP

1536:K5T1Xw6DJ8o58Kx/YrDN4QgaF1YOCYuzzKT5H5P3IYwivsH5cII42:K5T1Xwy2Rr8aF1TCYuzzKTbItw+I4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
418683bb308ef7e6281a3558378a05eb_JaffaCakes118

Files

418683bb308ef7e6281a3558378a05eb_JaffaCakes118
.exe windows:5 windows x86 arch:x86

d25862e97cf484747c4d29ff674f4f31

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLocalTime
InterlockedExchange
GetCommandLineW
InterlockedDecrement
GetStdHandle
GetACP
GetProcessHeap
InterlockedIncrement
GetThreadLocale
QueryPerformanceCounter
GetVolumeNameForVolumeMountPointW
lstrcmpW
MultiByteToWideChar

ulib

?Initialize@WSTRING@@QAEEPBGK@Z
?GetStandardOutput@PROGRAM@@UAEPAVSTREAM@@XZ
?PutSwitches@ARGUMENT_LEXEMIZER@@QAEXPBD@Z
?Initialize@ARRAY@@QAEEKK@Z
??1OBJECT@@UAE@XZ
??0PATH_ARGUMENT@@QAE@XZ
?Initialize@WSTRING@@QAEEPBDK@Z

ntdll

_aulldiv
NtWaitForSingleObject
NtQuerySystemTime
NtQuerySystemInformation
wcsstr
RtlFindMessage
wcslen
NtFsControlFile
RtlUnicodeStringToAnsiString
swprintf
RtlValidRelativeSecurityDescriptor
RtlNewSecurityObject

msvcrt

__initenv
strncmp
atoi
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
__p__fmode
__winitenv
strchr
toupper
_except_handler3
memmove
_XcptFilter
_adjust_fdiv
malloc
free
__getmainargs

Sections

.text
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d25862e97cf484747c4d29ff674f4f31

Headers

File Characteristics

Imports

kernel32

ulib

ntdll

msvcrt

Sections

.text Size: 49KB - Virtual size: 48KB

.rdata Size: 37KB - Virtual size: 36KB

.data Size: 2KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 49KB - Virtual size: 48KB

.rdata
Size: 37KB - Virtual size: 36KB

.data
Size: 2KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 4KB