00fd39bad9870a317a0b6a89f7fbe638_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

00fd39bad9870a317a0b6a89f7fbe638_JaffaCakes118
Size

165KB
MD5

00fd39bad9870a317a0b6a89f7fbe638
SHA1

edca603095946840a32c96e6b7102f038ca80e38
SHA256

e9419f59f03077385cb7760a67f0649729e6c1637fab744f84f38a961aec1541
SHA512

e29a57ef876a98076fbc5dacc45459f1f18bb1c0e36e3a8185ee5c09b86e4229effbfdde3090d7fd0aa7158a94e40ec5e34fd35e9c2fce3a54193eece9c6de96
SSDEEP

3072:ijZ6/EGqk3tMWJAGUp2+2ahw//9O9vK6IrYbfuC6UCUc+6sF2AxLK:iQcGqk3tMLJsWFYcC350X

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00fd39bad9870a317a0b6a89f7fbe638_JaffaCakes118

Files

00fd39bad9870a317a0b6a89f7fbe638_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d9de2ecd29cdbc447c689a4a1b8de57a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLocaleInfoA
RtlUnwind
HeapAlloc
SetHandleInformation
LoadLibraryA
GetEnvironmentStringsW
SetHandleCount
GetCurrentProcess
InterlockedDecrement
TerminateProcess
HeapReAlloc
QueryPerformanceCounter
SizeofResource
TlsFree
GetSystemInfo
VirtualQuery
FlushInstructionCache
GetModuleHandleA
GetCurrentThreadId
TlsAlloc
GetStartupInfoA
HeapCreate
SetFilePointer
GetThreadLocale
GetStdHandle
LeaveCriticalSection
TransmitCommChar
LoadResource
GetCommandLineA
HeapDestroy
IsBadReadPtr
EnterCriticalSection
RaiseException
GetFileType
SetUnhandledExceptionFilter
MulDiv
ExitProcess
GetTickCount
GetLastError
UnhandledExceptionFilter
lstrcmpiA
IsBadWritePtr
IsDBCSLeadByte
TlsGetValue
VirtualProtect
lstrcpyA
LockResource
GetProcAddress
GetVersionExA
EnumResourceNamesW
IsBadCodePtr
WideCharToMultiByte
WriteFile
lstrcatA
LCMapStringA
lstrlenW
DeleteCriticalSection
FreeLibrary
GetOEMCP
GetCPInfo
FreeEnvironmentStringsA
InterlockedExchange
VirtualAlloc
GetStringTypeW
CloseHandle
ExitProcess
DisableThreadLibraryCalls
LCMapStringW
VirtualFree
TlsSetValue
MultiByteToWideChar
InterlockedIncrement
SetLastError
GetCurrentProcessId
GetProcessHeap
lstrlenA
InitializeCriticalSection
GetACP
FreeEnvironmentStringsW
lstrcpynA
SetStdHandle
GetSystemTimeAsFileTime
GetModuleFileNameA
HeapSize
GetStringTypeA
FlushFileBuffers
LoadLibraryExA
FindResourceA
GetEnvironmentStrings
HeapFree

gdi32

GetTextExtentPointA
DeleteObject
GetTextMetricsA
SelectObject
GetDeviceCaps
CreateFontIndirectA

user32

UnregisterClassA
CheckDlgButton
MoveWindow
SetDlgItemTextA
IsDlgButtonChecked
GetDlgItemTextA
GetDlgItem
GetDialogBaseUnits
GetDC
DestroyWindow
SetWindowLongA
EnableWindow
IsWindow
WinHelpA
SendMessageA
CreateDialogParamA
ReleaseDC
ShowWindow
IsDialogMessageA
CharNextA

advapi32

RegSetValueExA
RegDeleteValueA
RegOpenKeyExA
RegEnumKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteKeyA
RegQueryInfoKeyA

msimg32

AlphaBlend
TransparentBlt

shlwapi

PathFindExtensionA

ole32

CoTaskMemAlloc
StringFromGUID2
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc

Sections

.text
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crt
Size: 512B - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d9de2ecd29cdbc447c689a4a1b8de57a

Headers

File Characteristics

Imports

kernel32

gdi32

user32

advapi32

msimg32

shlwapi

ole32

Sections

.text Size: 140KB - Virtual size: 140KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 19KB - Virtual size: 18KB

.crt Size: 512B - Virtual size: 68KB

.text
Size: 140KB - Virtual size: 140KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 19KB - Virtual size: 18KB

.crt
Size: 512B - Virtual size: 68KB