7ea649485794c1c7835061199d8ad079_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

7ea649485794c1c7835061199d8ad079_JaffaCakes118
Size

985KB
MD5

7ea649485794c1c7835061199d8ad079
SHA1

cc73021e996f44a28a5bfc1b173f6efc2b5c4f09
SHA256

cb8ef03afc88aa407a2dd2cc27d7bd4ca3ab54078ce653d4b0fe48f13cb7511a
SHA512

b9d7576f47a1eaee9149a2724e1f7fd47469f8b06b1222c14df97cf3614716631bd31740eadbc95f5e9ad7aee7dcadfaec7b7f4b6920729c5994105fb0bc4aaa
SSDEEP

24576:eYOdwbOIcfxvpsRTflffjvQOhqdI6oyMmanUz:SifcxvpsJft7gdxMu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7ea649485794c1c7835061199d8ad079_JaffaCakes118

Files

7ea649485794c1c7835061199d8ad079_JaffaCakes118
.exe windows:5 windows x86 arch:x86

386a44e1cbb727b4d16194f891a437d4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

AssocQueryStringW
AssocCreate
SHSetValueW
SHGetValueW
SHDeleteValueW
PathStripToRootW
PathRemoveFileSpecW
PathRemoveExtensionW
PathRemoveBackslashW
PathParseIconLocationW
PathIsURLW
PathIsNetworkPathW
PathIsUNCW
PathIsRootW
PathIsRelativeW
PathIsDirectoryW
PathFindFileNameW
PathFindExtensionW
PathFileExistsW
PathBuildRootW
StrStrIW
StrStrW
StrDupW
StrCmpNIW

kernel32

GetProcessHeap
CloseHandle
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
LCMapStringW
HeapSize
GetStringTypeW
HeapReAlloc
HeapAlloc
OutputDebugStringW
RtlUnwind
LoadLibraryExW
GlobalAlloc
VirtualAlloc
GetLastError
LeaveCriticalSection
MulDiv
lstrcmpW
lstrlenW
ExpandEnvironmentStringsW
IsProcessorFeaturePresent
IsDebuggerPresent
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
HeapFree
EnterCriticalSection
GetModuleHandleW
TlsFree
TlsSetValue
GetCommandLineW
SetLastError
GetCurrentThreadId
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue

oleaut32

RegisterTypeLi
VarBoolFromStr
VarBstrFromBool
VarCyFromStr
VarR8FromStr
VariantChangeTypeEx
VariantChangeType
VariantCopyInd
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayRedim
SysStringLen
SysAllocStringLen

Sections

.text
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 218KB - Virtual size: 7.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 1024B - Virtual size: 724B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.8soy2n
Size: 250KB - Virtual size: 250KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sahsn
Size: 290KB - Virtual size: 293KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

386a44e1cbb727b4d16194f891a437d4

Headers

File Characteristics

Imports

shlwapi

kernel32

oleaut32

Sections

.text Size: 82KB - Virtual size: 81KB

.data Size: 218KB - Virtual size: 7.0MB

.idata Size: 2KB - Virtual size: 2KB

.xdata Size: 1024B - Virtual size: 724B

.8soy2n Size: 250KB - Virtual size: 250KB

.sahsn Size: 290KB - Virtual size: 293KB

.rsrc Size: 139KB - Virtual size: 139KB

.text
Size: 82KB - Virtual size: 81KB

.data
Size: 218KB - Virtual size: 7.0MB

.idata
Size: 2KB - Virtual size: 2KB

.xdata
Size: 1024B - Virtual size: 724B

.8soy2n
Size: 250KB - Virtual size: 250KB

.sahsn
Size: 290KB - Virtual size: 293KB

.rsrc
Size: 139KB - Virtual size: 139KB