fb0fe3f62bf3b91cab1289f7ba3be799_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fb0fe3f62bf3b91cab1289f7ba3be799_JaffaCakes118
Size

72KB
MD5

fb0fe3f62bf3b91cab1289f7ba3be799
SHA1

18e68659549c9118cf0789cfe4869b1807fad980
SHA256

6dd081e9b93cd835744d1b893d8d2a90a95e96958525a14d4502290325ffdb14
SHA512

82c7d93afceded3fe00525514724a76863eaec34c947f3fe851eed18218426666584a450c2f9faf56dc61723fdb3e1cfc4c8d40bd2ce9ddc67a5ff9c1ed76c35
SSDEEP

1536:Ap9EwpG7UD3HMa8uyX9cQdRHyX/S5n+DCEB:69EzUDvfyX9cQdRi/S5BEB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb0fe3f62bf3b91cab1289f7ba3be799_JaffaCakes118

Files

fb0fe3f62bf3b91cab1289f7ba3be799_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e952e05892cad8ce9c9d7bee92ead1d4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetOpenUrlA
InternetReadFile
InternetOpenA
InternetCloseHandle

shlwapi

SHSetValueA
SHGetValueA
PathRemoveFileSpecA
PathFileExistsA
PathAppendA
SHDeleteKeyA
SHDeleteValueA

user32

GetWindowThreadProcessId
GetWindowTextA
FindWindowA
wsprintfA
PostMessageA
EnumWindows

msvcrt

_stricmp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_except_handler3
??1type_info@@UAE@XZ
_onexit
__dllonexit
memcpy
_CxxThrowException
strchr
strncpy
strncmp
_mbscmp
_mbsicmp
strtok
??2@YAPAXI@Z
??3@YAXPAX@Z
strcmp
strcpy
strcat
strstr
sprintf
isspace
__CxxFrameHandler
strlen
memset
strrchr
_controlfp

mfc42

ord6059
ord6282
ord6283
ord2818
ord1187
ord5710
ord5683
ord4278
ord3790
ord3176
ord1567
ord858
ord941
ord939
ord356
ord354
ord2770
ord2781
ord4058
ord860
ord540
ord800
ord535
ord940
ord537
ord665
ord1979
ord6385
ord353
ord5207
ord268
ord389
ord2763
ord3181
ord668
ord1980
ord2393
ord5583

kernel32

GetLastError
GetStartupInfoA
GetModuleHandleA
lstrcpyA
lstrcatA
GetTempPathA
CreateFileA
WriteFile
CreateMutexA
Sleep
GetWindowsDirectoryA
DeleteFileA
SetErrorMode
LoadLibraryExA
RemoveDirectoryA
HeapAlloc
SetLastError
HeapFree
WideCharToMultiByte
OpenProcess
WaitForSingleObject
TerminateProcess
CloseHandle
FreeLibrary
LoadLibraryA
GetProcAddress

advapi32

RegDeleteValueA
RegDeleteKeyA
RegEnumKeyExA
RegCloseKey
SetNamedSecurityInfoA
RegEnumKeyA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumValueA

shell32

SHGetSpecialFolderPathA
ShellExecuteA

ole32

OleInitialize
OleUninitialize

Sections

.text
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e952e05892cad8ce9c9d7bee92ead1d4

Headers

File Characteristics

Imports

wininet

shlwapi

user32

msvcrt

mfc42

kernel32

advapi32

shell32

ole32

Sections

.text Size: 44KB - Virtual size: 41KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 16KB - Virtual size: 15KB

.text
Size: 44KB - Virtual size: 41KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 16KB - Virtual size: 15KB