f77891ed9bb0d1fc43b278dbd277ab97_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

f77891ed9bb0d1fc43b278dbd277ab97_JaffaCakes118
Size

733KB
MD5

f77891ed9bb0d1fc43b278dbd277ab97
SHA1

20b1ad3106fc2d04192b2cde70ca51e1b77ca189
SHA256

e4e8f230a2e9782b991ff202b3b9aa167f1967311f54871bef999bb7b55611df
SHA512

7b788d0147ccabd89f397bb3b9e592344ce38db9d6a7116605a43f2857ee3e460636d9ede44d1dd0a9267bd4b55eeb1a1e87965c7e9c0e941113d6cadaa94ef7
SSDEEP

12288:8SP+MwHRpRAFamRypJOGUgD1D0JIDNw+9tMaj5ShGXeiCtumV5UwCdkJy1ix:8WapRAFVRy/XJdxT1S0ALDUwukJyy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f77891ed9bb0d1fc43b278dbd277ab97_JaffaCakes118

Files

f77891ed9bb0d1fc43b278dbd277ab97_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b79a2e9b945e7165b2166fa98e7c2334

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Documents and Settings\ben\My Documents\Visual Studio Projects\Est\WrapperStub\Release\WrapperStub.pdb

Imports

wininet

InternetSetCookieA

kernel32

CompareFileTime
FreeLibrary
GetLastError
CloseHandle
GetExitCodeProcess
Sleep
OpenProcess
SetLastError
GetProcAddress
LoadLibraryA
GetVersion
GetFileAttributesA
FindFirstFileA
_lwrite
_lread
CreateProcessA
lstrlenA
lstrcatA
HeapFree
GetLogicalDriveStringsA
GetDriveTypeA
GetDiskFreeSpaceA
RemoveDirectoryA
_lclose
_lcreat
CreateDirectoryA
DeleteFileA
GetTempFileNameA
GetTempPathA
_llseek
_lopen
GetModuleFileNameA
SetStdHandle
GetSystemInfo
VirtualProtect
GetLocaleInfoA
VirtualQuery
GetProcessHeap
HeapAlloc
HeapReAlloc
FlushFileBuffers
FormatMessageA
HeapSize
lstrcpyA
ExitProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
GetACP
GetOEMCP
GetCPInfo
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
SetFilePointer
RtlUnwind
InterlockedExchange

user32

PeekMessageA
TranslateMessage
DispatchMessageA
MessageBoxA

advapi32

RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyExA
RegCloseKey

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b79a2e9b945e7165b2166fa98e7c2334

Headers

File Characteristics

PDB Paths

Imports

wininet

kernel32

user32

advapi32

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 4KB - Virtual size: 2KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 4KB - Virtual size: 2KB