5d7ce2398942eb03bd0065aea3d5da15_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

5d7ce2398942eb03bd0065aea3d5da15_JaffaCakes118
Size

406KB
MD5

5d7ce2398942eb03bd0065aea3d5da15
SHA1

8c1977305284f6ef719d6e92f0e90f069476a62a
SHA256

705e14735da74b107357a676c15b07c0f0c86888b8f98ba86e1029ff4e4858df
SHA512

a014ab056f924d3a037df8bbdd59cc8e3f95a25c5c6fed04a5a90aa848aca5af2700b4ae1367d9a92efe7eb82265c8c5ecf5e24ba251bc752c68ba49bece9fa6
SSDEEP

6144:MU/OLpMfiR6vtVIgyPFiChgkX7WOMeLpebnZgUe4A29pNwzg:MU/OLCf1LqPACIeoFa4A29Dwzg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

5d7ce2398942eb03bd0065aea3d5da15_JaffaCakes118

resource
5d7ce2398942eb03bd0065aea3d5da15_JaffaCakes118

Files

5d7ce2398942eb03bd0065aea3d5da15_JaffaCakes118
.dll windows:6 windows x86 arch:x86

c6999771217f1216d96e792ac4717a66

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\9\Similar\7\82\Listen\22\17\2\Sleep\92\toward\39\89\live.pdb

Imports

kernel32

VirtualProtectEx
Sleep
TlsAlloc
TlsSetValue
GetModuleFileNameA
GetModuleHandleA
GetEnvironmentVariableA
GetSystemDirectoryA
GetTempPathA
GetWindowsDirectoryA
RemoveDirectoryA
CloseHandle
DecodePointer
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetStdHandle
GetStringTypeW
SetFilePointerEx
GetFileSizeEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
TlsGetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RaiseException
RtlUnwind
InterlockedFlushSList
GetLastError
EncodePointer
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleExW
GetStdHandle
GetFileType
WriteConsoleW
HeapAlloc
HeapValidate
GetSystemInfo
ExitProcess
WriteFile
OutputDebugStringW
LCMapStringW
HeapFree
HeapReAlloc
HeapSize
HeapQueryInformation
GetProcessHeap
CreateFileW

msacm32

acmStreamUnprepareHeader
acmStreamPrepareHeader
acmStreamConvert
acmStreamMessage
acmStreamReset
acmStreamSize
acmStreamClose
acmStreamOpen
acmFilterChooseA
acmFilterEnumA
acmFilterDetailsA
acmFilterTagEnumA
acmFilterTagDetailsA
acmFormatChooseA
acmFormatSuggest
acmFormatEnumA
acmFormatDetailsA
acmFormatTagEnumA
acmFormatTagDetailsA
acmDriverPriority
acmDriverOpen
acmDriverRemove
acmMetrics
acmGetVersion

Exports

Exports

Joinmy
Soldiertriangle
Yellowsaid

Sections

.text
Size: 381KB - Virtual size: 381KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 349KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c6999771217f1216d96e792ac4717a66

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msacm32

Exports

Exports

Sections

.text Size: 381KB - Virtual size: 381KB

.data Size: 5KB - Virtual size: 349KB

.idata Size: 3KB - Virtual size: 2KB

.gfids Size: 512B - Virtual size: 284B

.reloc Size: 14KB - Virtual size: 14KB

.text
Size: 381KB - Virtual size: 381KB

.data
Size: 5KB - Virtual size: 349KB

.idata
Size: 3KB - Virtual size: 2KB

.gfids
Size: 512B - Virtual size: 284B

.reloc
Size: 14KB - Virtual size: 14KB