9ed293c86147739bd62f6f5f497c3927_JaffaCakes118

General

Target

9ed293c86147739bd62f6f5f497c3927_JaffaCakes118
Size

22KB
MD5

9ed293c86147739bd62f6f5f497c3927
SHA1

2f3233e5e01c7fa378f67e969e3e8a6bb2bb0da6
SHA256

b9ce83b4786604bf786c5fe0c858ecc407834a406bb3f420b42eddda07d61b56
SHA512

f859c88076726b9d27597597ec435044860e9253fa3b00f616c7a1627230e1f1288d9be30a08e5594a640cee20693db7718ef2a768477c7d215977bd268227f6
SSDEEP

384:HLKK6jt8N/W3GI72FFJtaTp7dvtpbUsg0sxYxqny8Y6qWhUc9/1XlB:HLW58NL+y+TXt+C/Unp7hUQVB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
9ed293c86147739bd62f6f5f497c3927_JaffaCakes118

Files

9ed293c86147739bd62f6f5f497c3927_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6ffd83112913f5d7133de7ac08d9dff7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalFree
GlobalAlloc
GetSystemDirectoryA
GetWindowsDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDefaultUILanguage
GlobalMemoryStatusEx
GetVersionExA
lstrcpyA
CloseHandle
GetCurrentProcess
OutputDebugStringA
CreateProcessA
ExitProcess
DeleteFileA
ReleaseMutex
OpenMutexA
InterlockedExchange
CreateThread
Sleep
WaitForSingleObject
GetLastError
CreateMutexA
SetPriorityClass
GetModuleFileNameA
GetStartupInfoA
ResumeThread
SetThreadPriority
GetCurrentThread
lstrcatA
GetEnvironmentVariableA
GetShortPathNameA
SetFileAttributesA
CopyFileA
lstrcmpiA
GetModuleHandleA
SetErrorMode
GetTickCount
GetCurrentProcessId
VirtualAlloc
VirtualQueryEx
ReadProcessMemory
GetThreadContext
TerminateProcess
SetThreadContext
WriteProcessMemory
VirtualProtectEx
VirtualFree
ReadFile
GetFileSize
SetFilePointer
CreateFileA
RaiseException
LocalAlloc

msvcrt

atoi
strncpy
strcspn
rand
srand
memmove
??3@YAXPAX@Z
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
??2@YAPAXI@Z
sprintf
strstr

Sections

360safe
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6ffd83112913f5d7133de7ac08d9dff7

Headers

File Characteristics

Imports

kernel32

msvcrt

Sections

360safe Size: 13KB - Virtual size: 13KB

.text Size: 2KB - Virtual size: 1KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 2KB - Virtual size: 6KB

360safe
Size: 13KB - Virtual size: 13KB

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 2KB - Virtual size: 6KB