173e368307d01370e9cf640ea3737b7b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

173e368307d01370e9cf640ea3737b7b_JaffaCakes118
Size

869KB
MD5

173e368307d01370e9cf640ea3737b7b
SHA1

6878a147aa0d42586ac0b30dd968a65be5b584b6
SHA256

d34b46957514a3b13da55ad21a007e3b6d7491263c45c1ae68ea2fd65604e694
SHA512

28e0720ea63d383f054121b7d8154ecf1c8a69dd11d9dfc8115798487d4ae615a241432a70b1616be8d6cee9f956413378bd591cd4c27ddfc1d30e2e95680034
SSDEEP

24576:wY0Dvj4pWp/adm9MOi5VO950yKJHrPuSQm/UQzz:eDb4eSJOi/qiyKKSQqf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
173e368307d01370e9cf640ea3737b7b_JaffaCakes118

Files

173e368307d01370e9cf640ea3737b7b_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e1eb3ea8413981659e395bf7ab81e2aa

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GlobalAlloc
GlobalLock
GlobalUnlock
VirtualAlloc
HeapAlloc
HeapReAlloc
HeapFree
GetCurrentProcess
GetCurrentThreadId
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
ReadFile
FindClose
CloseHandle
MulDiv
GetSystemInfo
LoadLibraryW
LoadLibraryExW
CreateProcessW
ExpandEnvironmentStringsW
OutputDebugStringW
FindResourceW
FindFirstFileW
FindNextFileW
GetLocaleInfoW
GetThreadLocale
GetConsoleMode
FreeConsole

userenv

GetUserProfileDirectoryW
ExpandEnvironmentStringsForUserW

user32

FindWindowExW
FindWindowW
IntersectRect
GetClientRect
EndPaint
BeginPaint
DeleteMenu
SetMenu
GetMenu
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
CharPrevW
RegisterClipboardFormatW
GetClassInfoW
RegisterWindowMessageW
ActivateKeyboardLayout
SetRectEmpty

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__p___winitenv
exit
_XcptFilter
_exit

psapi

GetProcessImageFileNameW

oleaut32

SafeArrayUnaccessData
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayRedim
SafeArrayGetElement
SafeArrayPutElement
SafeArrayPtrOfIndex
VariantClear
VariantCopy
VariantCopyInd
VarR8FromStr
VarDateFromStr
VarCyFromStr
VarBstrFromCy
VarBstrFromDate
VarBoolFromStr
VarNeg
GetErrorInfo
CreateErrorInfo
VarNot
SafeArrayCreate
SysStringLen
SysAllocStringLen
SysReAllocStringLen
SysFreeString

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 265KB - Virtual size: 6.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sc3a
Size: 187KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.otgoe
Size: 282KB - Virtual size: 282KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e1eb3ea8413981659e395bf7ab81e2aa

Headers

File Characteristics

Imports

kernel32

userenv

user32

msvcrt

psapi

oleaut32

Sections

.text Size: 22KB - Virtual size: 21KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 265KB - Virtual size: 6.9MB

.sc3a Size: 187KB - Virtual size: 186KB

.otgoe Size: 282KB - Virtual size: 282KB

.rsrc Size: 108KB - Virtual size: 108KB

.text
Size: 22KB - Virtual size: 21KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 265KB - Virtual size: 6.9MB

.sc3a
Size: 187KB - Virtual size: 186KB

.otgoe
Size: 282KB - Virtual size: 282KB

.rsrc
Size: 108KB - Virtual size: 108KB