6305aef24799b0e69592d8813b6daba0_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

6305aef24799b0e69592d8813b6daba0_JaffaCakes118
Size

1.1MB
MD5

6305aef24799b0e69592d8813b6daba0
SHA1

2cbafc0917f3baf7421cc12a3a48753c0c1c1493
SHA256

12ebaae1c3ca043b4279a25269698dc1187c41b8e47ebcd47a580929941cb40e
SHA512

4bdf72f5c8cefddf00cd1fdcf74c92373c9f30caa320fb3c3187184e509cb1a5d120576ed6587d19591f3cffdb0b9e8004bde8f3a64a7370411b40c14206d667
SSDEEP

24576:33+7jdF0T7WKynBcuLFVqYlwXYGNYeDnODNV:HCpW6KEGmvqYlwIGnjOz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6305aef24799b0e69592d8813b6daba0_JaffaCakes118

Files

6305aef24799b0e69592d8813b6daba0_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e958032522accc98eb83e317b2e0662f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStringTypeW
LCMapStringW
WideCharToMultiByte
MultiByteToWideChar
GetOEMCP
QueryPerformanceCounter
GetFileAttributesW
CreateDirectoryW
FindResourceW
GetModuleHandleW
SystemTimeToFileTime
GetLocalTime
SetFilePointer
ReleaseSemaphore
InitializeCriticalSectionAndSpinCount
GetLastError
GetCurrentThreadId
GetCurrentProcessId
VirtualAlloc
GlobalAlloc
InterlockedIncrement
InterlockedDecrement
GetStringTypeA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
HeapAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
LCMapStringA

crypt32

CryptBinaryToStringW
CryptStringToBinaryW
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CryptProtectData
CryptQueryObject
CertGetNameStringW
CertNameToStrW
CryptAcquireCertificatePrivateKey
CertVerifyTimeValidity
CertAddStoreToCollection
CertFreeCTLContext
CertAddCertificateContextToStore
CertFreeCRLContext
CryptEncodeObject
CryptEnumOIDInfo
CryptMsgOpenToDecode
CryptMsgClose
CryptMsgUpdate
CryptMsgGetParam
CertCloseStore
CertCreateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty

comdlg32

PageSetupDlgW
CommDlgExtendedError
PrintDlgExW
ChooseFontW
ChooseColorW

secur32

InitializeSecurityContextW
GetUserNameExW

shlwapi

SHDeleteKeyW
PathRemoveBlanksW
PathIsUNCServerW
PathFindFileNameW
PathCombineW
PathCanonicalizeW
PathAppendW
StrCmpIW
StrDupW
PathIsDirectoryW

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 6.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fon8ge
Size: 486KB - Virtual size: 486KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.1st0
Size: 248KB - Virtual size: 247KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 365KB - Virtual size: 365KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e958032522accc98eb83e317b2e0662f

Headers

File Characteristics

Imports

kernel32

crypt32

comdlg32

secur32

shlwapi

Sections

.text Size: 35KB - Virtual size: 34KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 11KB - Virtual size: 6.9MB

.fon8ge Size: 486KB - Virtual size: 486KB

.1st0 Size: 248KB - Virtual size: 247KB

.rsrc Size: 365KB - Virtual size: 365KB

.text
Size: 35KB - Virtual size: 34KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 11KB - Virtual size: 6.9MB

.fon8ge
Size: 486KB - Virtual size: 486KB

.1st0
Size: 248KB - Virtual size: 247KB

.rsrc
Size: 365KB - Virtual size: 365KB