9a4ca29834afb05956baa6d43941fdd4_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

9a4ca29834afb05956baa6d43941fdd4_JaffaCakes118
Size

512KB
MD5

9a4ca29834afb05956baa6d43941fdd4
SHA1

2ffceafd456c1697b6f93271a49936f0e809b076
SHA256

158d4f21670da0bdc2551260287309dce6643058dfb50c021b8e81a86e82dad2
SHA512

a3c50675f0959dfdd80d004bdf5db39469e206afcbea1f1f0a94bbb170b7baa63af8577f1c64a0acfab469e345d9288bdde1d349761064bbec1c0b0e6ae59449
SSDEEP

6144:cRm3AUGMaF7L7UEY41IDb/iCWYWHohrUi7N9iN9sWkgXFgx9XNP85B671xBvekLR:cIwU87fB1eb/49IhQg9ZOgx9sBc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

9a4ca29834afb05956baa6d43941fdd4_JaffaCakes118

resource
9a4ca29834afb05956baa6d43941fdd4_JaffaCakes118

Files

9a4ca29834afb05956baa6d43941fdd4_JaffaCakes118
.exe windows:5 windows x86 arch:x86

29b240d4c4ec3c9e4109ff572d35e999

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\pibudimug hoje86 wizukokabo_waz.pdb

Imports

kernel32

CreateHardLinkA
GetTickCount
WriteFile
GetUserDefaultLangID
GetUserGeoID
GetProcessTimes
GetConsoleMode
SizeofResource
ReplaceFileW
IsBadStringPtrA
WritePrivateProfileStringW
GlobalUnlock
BackupRead
GetProcAddress
GetTapeStatus
RemoveDirectoryA
LoadLibraryA
GetCommMask
GetTapeParameters
SetConsoleTitleW
BuildCommDCBA
VirtualProtect
OpenFileMappingA
LocalFree
TlsFree
GetCurrentProcess
GlobalAddAtomA
GetProcessIoCounters
RtlCaptureContext
lstrlenA
SetProcessAffinityMask
UnregisterWait
GlobalFix
GetModuleHandleW
ExitProcess
DecodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
GetLastError
LoadLibraryW
TlsAlloc
TlsGetValue
TlsSetValue
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapFree
Sleep
HeapSize
RtlUnwind
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapAlloc
HeapReAlloc
IsProcessorFeaturePresent
RaiseException

advapi32

RegSetValueExW
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
GetNumberOfEventLogRecords
DeregisterEventSource

Sections

.text
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 333KB - Virtual size: 333KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 22.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

29b240d4c4ec3c9e4109ff572d35e999

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

Sections

.text Size: 51KB - Virtual size: 50KB

.rdata Size: 333KB - Virtual size: 333KB

.data Size: 21KB - Virtual size: 22.4MB

.rsrc Size: 78KB - Virtual size: 77KB

.text
Size: 51KB - Virtual size: 50KB

.rdata
Size: 333KB - Virtual size: 333KB

.data
Size: 21KB - Virtual size: 22.4MB

.rsrc
Size: 78KB - Virtual size: 77KB