JaffaCakes118_d61b9fad2ece460a696b77c95a441606

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_d61b9fad2ece460a696b77c95a441606
Size

268KB
MD5

d61b9fad2ece460a696b77c95a441606
SHA1

9eacc1adba5850e5e2f2d8b2e74902ff38198a19
SHA256

c516d6604b3dec29dc4907ffc43a90953dc751c946cd1e0c0fe695a4e20e2c81
SHA512

50f0dc91677f7091e84a05558992af9131a3df2b553a040b8bd937affb0bd02705aeadc7b1ab95527c3e97371ff6a1722d72f27f7565f605a67acff4475a4e06
SSDEEP

6144:wZhwBrnkQsbJmzLVy0J6eYhpgV97vPyuNXq:WLpszLVgeYhpgv7vPyM6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_d61b9fad2ece460a696b77c95a441606

Files

JaffaCakes118_d61b9fad2ece460a696b77c95a441606
.exe windows:4 windows x86 arch:x86

6b682ab991cdc28610945d01443f820f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsDebuggerPresent
GetLastError
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
CreateEventW
lstrlenW
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
GetModuleFileNameW
WaitForMultipleObjects
SetEvent
MulDiv
GetModuleHandleW
WaitForSingleObject
LoadLibraryW
FreeLibrary
lstrcpynW
GetVersionExW
lstrcmpW
GetProcAddress
LoadLibraryA

user32

LoadIconW
GetFocus
SetCursor
CopyRect
GetIconInfo
DestroyIcon
IsWindow
GetSysColor
InvalidateRect
GetSystemMetrics
EnableWindow
LoadImageW
IsIconic
PostMessageW
SendMessageW
LoadCursorW

gdi32

GetStockObject
DeleteObject
CreatePen
CreateFontIndirectW
CreatePatternBrush
CreatePalette
CreateRectRgn
CreateCompatibleDC
CreateSolidBrush

comctl32

ord17

query

CIState
DllCanUnloadNow
BeginCacheTransaction
CiSvcMain
InitializeCIISAPIPerformanceData

mscat32

CryptCATEnumerateAttr
CryptCATAdminReleaseContext
MsCatConstructHashTag
CryptCATStoreFromHandle
CryptCATGetCatAttrInfo

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 1KB - Virtual size: 273KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 2KB - Virtual size: 432KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 86KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 133KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6b682ab991cdc28610945d01443f820f

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comctl32

query

mscat32

Sections

.text Size: 9KB - Virtual size: 9KB

.text Size: 16KB - Virtual size: 16KB

.edata Size: 1KB - Virtual size: 273KB

.rdata Size: 2KB - Virtual size: 35KB

.edata Size: 2KB - Virtual size: 432KB

.edata Size: 86KB - Virtual size: 121KB

.data Size: 6KB - Virtual size: 363KB

.edata Size: 133KB - Virtual size: 150KB

.rsrc Size: 10KB - Virtual size: 10KB

.text
Size: 9KB - Virtual size: 9KB

.text
Size: 16KB - Virtual size: 16KB

.edata
Size: 1KB - Virtual size: 273KB

.rdata
Size: 2KB - Virtual size: 35KB

.edata
Size: 2KB - Virtual size: 432KB

.edata
Size: 86KB - Virtual size: 121KB

.data
Size: 6KB - Virtual size: 363KB

.edata
Size: 133KB - Virtual size: 150KB

.rsrc
Size: 10KB - Virtual size: 10KB