0f8253c71ec176d230711305335e799d_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

0f8253c71ec176d230711305335e799d_JaffaCakes118
Size

3.8MB
MD5

0f8253c71ec176d230711305335e799d
SHA1

454e4dd4afc6bb344a5e45581b664fe822855b32
SHA256

da9e78e7fa2e933cf4da6ff2e829298a764a2452b96909b0581b8f9781f54f79
SHA512

399713698260d0c3afc95e8976792b0c1c7e62a319677ce6b568166cb35388c5391300344a59e69565d08a55cb896440e3b4d253928d4a1ecf7ad036e8f7e231
SSDEEP

98304:XYI0r/IVahcO2cEMjwhHt/cM6RVtzufa:XY/DIGcOZEZFtkXRbz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

0f8253c71ec176d230711305335e799d_JaffaCakes118

resource
0f8253c71ec176d230711305335e799d_JaffaCakes118

Files

0f8253c71ec176d230711305335e799d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

c493b6546a20e93d6a3e2d05ff9eea51

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
FindResourceA
HeapAlloc
GetCurrentProcess
GetModuleHandleExW
GetTimeFormatA
GetTickCount
GetConsoleAliasesA
ActivateActCtx
GlobalAlloc
GetLocaleInfoW
SizeofResource
GetFileAttributesA
FindNextVolumeMountPointW
CreateJobObjectA
GetProcAddress
HeapSize
GetConsoleDisplayMode
FreeUserPhysicalPages
GetAtomNameA
SetConsoleCtrlHandler
GetModuleHandleA
InterlockedIncrement
InterlockedDecrement
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
GetStartupInfoW
HeapValidate
IsBadReadPtr
RaiseException
RtlUnwind
TlsGetValue
GetModuleHandleW
TlsAlloc
TlsSetValue
GetCurrentThreadId
TlsFree
SetLastError
GetLastError
DebugBreak
GetStdHandle
WriteFile
OutputDebugStringA
WriteConsoleW
GetFileType
OutputDebugStringW
LoadLibraryW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapDestroy
HeapCreate
HeapFree
VirtualFree
GetModuleFileNameA
FlushFileBuffers
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
SetFilePointer
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
LoadLibraryA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
ReadFile
CloseHandle
CreateFileA

Exports

Exports

Memory
Roses
Sos
Surrender

Sections

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 4.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c493b6546a20e93d6a3e2d05ff9eea51

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 3.8MB - Virtual size: 3.8MB

.rdata Size: 38KB - Virtual size: 37KB

.data Size: 10KB - Virtual size: 4.3MB

.rsrc Size: 10KB - Virtual size: 9KB

.text
Size: 3.8MB - Virtual size: 3.8MB

.rdata
Size: 38KB - Virtual size: 37KB

.data
Size: 10KB - Virtual size: 4.3MB

.rsrc
Size: 10KB - Virtual size: 9KB