JaffaCakes118_7a4c24873d2241d6f197f1ee79741cba

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_7a4c24873d2241d6f197f1ee79741cba
Size

621KB
MD5

7a4c24873d2241d6f197f1ee79741cba
SHA1

7717d9b8e48618667ed296adbed3aac9173efbbe
SHA256

b12483974354ca0907ec1d440e9dd067be58d05713cc42a6fe8b7d123cab93f0
SHA512

69aaf55d631dfab6dbd12452a4f799767b3e94f5d0bd0f3fd4847c18b9d4c109ab36612c2e4e4e33c363c0ee9e5d1d8ee1a984df33c262116fe5103a9c392193
SSDEEP

12288:Hi7hn9EfxUioMtIvLdX1eN6xIbBtZ1Y87u40Pb+mGCJ1J92R:Hi7sfxmMtA6YQtjdH0LGCzJg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_7a4c24873d2241d6f197f1ee79741cba

Files

JaffaCakes118_7a4c24873d2241d6f197f1ee79741cba
.exe windows:6 windows x86 arch:x86

a79c35de7194e499344a5a045217c1af

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

findstr.pdb

Imports

kernel32

FindClose
FindNextFileA
FindFirstFileA
ReadFile
WriteFile
LeaveCriticalSection
SetConsoleTextAttribute
GetStdHandle
EnterCriticalSection
SetFileApisToOEM
IsDBCSLeadByte
GetLastError
FormatMessageA
CreateFileA
GetFileAttributesA
ExitProcess
SetConsoleCtrlHandler
InitializeCriticalSection
UnmapViewOfFile
CloseHandle
MapViewOfFile
CreateFileMappingA
GetFileSize
SetCurrentDirectoryA
GetCurrentDirectoryA
lstrlenA
GetConsoleOutputCP
GetConsoleScreenBufferInfo
SetThreadPreferredUILanguages
HeapSetInformation
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
Sleep
InterlockedExchange
UnhandledExceptionFilter

msvcrt

strcpy_s
strcat_s
_splitpath_s
malloc
fprintf
isalnum
isspace
isprint
_iob
_ultoa
strchr
fclose
fgets
fopen
_itoa
_isatty
tolower
isxdigit
_stricmp
_setmode
_fileno
strncpy_s
_wsetlocale
clock
memset
__getmainargs
_cexit
_exit
_XcptFilter
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
?terminate@@YAXXZ
_controlfp
swprintf_s
isalpha
_strupr
_strnicoll
_strncoll
memmove
memcpy
exit
free
strcspn
strcoll
isupper
_strlwr
islower
sprintf_s

user32

CharToOemA

ntdll

RtlUnicodeToOemN
DbgPrint
RtlMultiByteToUnicodeN

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp1
Size: 560KB - Virtual size: 1.7MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a79c35de7194e499344a5a045217c1af

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcrt

user32

ntdll

Sections

.text Size: 20KB - Virtual size: 20KB

.data Size: 36KB - Virtual size: 35KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 1KB - Virtual size: 1KB

.vmp1 Size: 560KB - Virtual size: 1.7MB

.text
Size: 20KB - Virtual size: 20KB

.data
Size: 36KB - Virtual size: 35KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1KB - Virtual size: 1KB

.vmp1
Size: 560KB - Virtual size: 1.7MB