JaffaCakes118_82b3608606028f7e9bf7f15045c275a5d839652151123c42c2d5ca152844425b

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_82b3608606028f7e9bf7f15045c275a5d839652151123c42c2d5ca152844425b
Size

174KB
MD5

d7fcb9d73b6836591c14b66aa2a8465b
SHA1

fefc520146c691f4e345a3465c0c759248df7e1e
SHA256

82b3608606028f7e9bf7f15045c275a5d839652151123c42c2d5ca152844425b
SHA512

ae3fd51618e7386fc6d3c79f3d05a746bde751268cc16c8418346cdca59d5635e14c5ad3ba12913967c21b2fe75cc5a1c0b34fe754b1f880c6938f1e7ddb3d2e
SSDEEP

3072:lXLo76LYs7jPk5lGIoNL1h08ElTwqAgAZeXKrkoi+M2oWka81dPjwZnHdNgx:lXLoGe5l6LYrlEqFAZe6rUF0cjoNgx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/0c562a5c681740b9496f31015d6ec74b9daf4ca21ce5dbde6788c866fb0d6aea.exe

Files

JaffaCakes118_82b3608606028f7e9bf7f15045c275a5d839652151123c42c2d5ca152844425b
.zip

Password: infected
0c562a5c681740b9496f31015d6ec74b9daf4ca21ce5dbde6788c866fb0d6aea.zip
.zip

Password: infected
0c562a5c681740b9496f31015d6ec74b9daf4ca21ce5dbde6788c866fb0d6aea.exe
.exe windows:5 windows x86 arch:x86

076f9439ada79e4adafd15c381fdc110

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\comufucuh75_ras.pdb

Imports

kernel32

GetConsoleAliasesLengthA
GetConsoleTitleA
InitializeCriticalSection
GetVolumePathNameW
LoadLibraryW
GetProcessHandleCount
InterlockedPopEntrySList
LeaveCriticalSection
lstrcpynW
WriteConsoleW
LocalHandle
GetModuleFileNameW
GetConsoleAliasesW
SetLastError
GetLongPathNameA
MoveFileW
WriteProfileSectionA
WriteConsoleA
LocalAlloc
IsWow64Process
GetModuleFileNameA
UpdateResourceW
GetConsoleTitleW
VirtualProtect
GetShortPathNameW
GetFileInformationByHandle
SetFileAttributesW
CreateThread
CreateFileW
LCMapStringW
SetMailslotInfo
SetConsoleTextAttribute
LoadLibraryA
GetConsoleAliasesLengthW
InterlockedIncrement
InterlockedDecrement
Sleep
DeleteCriticalSection
EnterCriticalSection
EncodePointer
DecodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetLastError
HeapFree
RtlUnwind
HeapAlloc
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
HeapSize
GetProcAddress
GetModuleHandleW
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
RaiseException
WriteFile
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeW
MultiByteToWideChar
GetConsoleCP
GetConsoleMode
HeapReAlloc
SetStdHandle
FlushFileBuffers
CloseHandle

user32

ClientToScreen

gdi32

GetTextExtentExPointW

advapi32

ClearEventLogA

Sections

.text
Size: 179KB - Virtual size: 178KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12.8MB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

076f9439ada79e4adafd15c381fdc110

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

Sections

.text Size: 179KB - Virtual size: 178KB

.data Size: 26KB - Virtual size: 59KB

.rsrc Size: 32KB - Virtual size: 31KB

.reloc Size: 12.8MB - Virtual size: 6KB

.text
Size: 179KB - Virtual size: 178KB

.data
Size: 26KB - Virtual size: 59KB

.rsrc
Size: 32KB - Virtual size: 31KB

.reloc
Size: 12.8MB - Virtual size: 6KB