40444b90bd5958da9755fb620fd1e65e_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

40444b90bd5958da9755fb620fd1e65e_JaffaCakes118
Size

4.7MB
MD5

40444b90bd5958da9755fb620fd1e65e
SHA1

39796cf88ff95f5a9da2a066275c2cc1674cf656
SHA256

cc7920af93268d2c1192298da4a7e7cd899fdf7d7a9417b4abacb2a183cf26c7
SHA512

7530e67f23bae5fe4bd1104ae7962e10ee64f5dcb08e7ede39ce2a023741fa811c5172e8f6d603c356062f8197dc5dc0d13a55ea2f8547327c6620d45c4e0bca
SSDEEP

49152:et+y0SqDgVUUG5zdUHjZ4UHMYcYbjAC+og:0+lzgy/3ntujcog

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40444b90bd5958da9755fb620fd1e65e_JaffaCakes118

Files

40444b90bd5958da9755fb620fd1e65e_JaffaCakes118
.exe windows:5 windows x86 arch:x86

154f79b263ed59e025735505dd7113ba

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
GetLastError
GetLocalTime
GetSystemInfo
SystemTimeToFileTime
FormatMessageW
GetCommandLineW
GetVersionExW
CloseHandle
DuplicateHandle
WaitForSingleObject
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetExitCodeThread
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WriteConsoleW
SetStdHandle
GetStringTypeW
LoadLibraryW
EncodePointer
DecodePointer
RtlUnwind
GetCommandLineA
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetTickCount
GetModuleHandleW
GetProcAddress
CreateSemaphoreW
CreateThread
ExitThread
LoadLibraryExW
RaiseException
HeapFree
CreateTimerQueue
SetEvent
WaitForSingleObjectEx
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
GetModuleFileNameA
WriteFile
GetModuleFileNameW
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsDebuggerPresent
HeapAlloc
HeapSize
OutputDebugStringW
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleA
VirtualFree
VirtualProtect
ReleaseSemaphore
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
LCMapStringW
CreateFileW

wintrust

CryptCATCatalogInfoFromContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseContext
CryptCATAdminAcquireContext
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WinVerifyTrust

Sections

.text
Size: 186KB - Virtual size: 185KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3.6MB - Virtual size: 11.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 927KB - Virtual size: 926KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

154f79b263ed59e025735505dd7113ba

Headers

File Characteristics

Imports

kernel32

wintrust

Sections

.text Size: 186KB - Virtual size: 185KB

.rdata Size: 43KB - Virtual size: 43KB

.data Size: 3.6MB - Virtual size: 11.1MB

.rsrc Size: 927KB - Virtual size: 926KB

.text
Size: 186KB - Virtual size: 185KB

.rdata
Size: 43KB - Virtual size: 43KB

.data
Size: 3.6MB - Virtual size: 11.1MB

.rsrc
Size: 927KB - Virtual size: 926KB