020ab140042c35ebc2660a4dcd987c61_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

020ab140042c35ebc2660a4dcd987c61_JaffaCakes118
Size

521KB
MD5

020ab140042c35ebc2660a4dcd987c61
SHA1

6bfc5593bf955aff8f4dbe2ac568c2ce8326dd7d
SHA256

40ebb85a6e984ebd0e3b828c71fe8a37f19c24559bfffe832023bcc2671080d5
SHA512

5422d47661bbff289d01798493713269d0114e4df111426ad62370f9904c31ae85829a29c450d4dd858ae9010f54d84a8b4d65501cb0661961b3df0af2c7aaf5
SSDEEP

12288:sUo123x2Pue23Arxi6QgHKxKdFiuO/WKCQRy0f:sUo1iQPJ230iDYouOOzA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
020ab140042c35ebc2660a4dcd987c61_JaffaCakes118

Files

020ab140042c35ebc2660a4dcd987c61_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dc286ea92893864bcf8c30a4d5b7be42

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeEnvironmentStringsW
GetFileType
VirtualFree
ExitProcess
GetCPInfo
TlsSetValue
CreateMutexA
HeapValidate
GetProcAddress
MultiByteToWideChar
GetCurrentProcessId
GetCurrentProcess
GetCurrentThread
GetVersion
GetEnvironmentStrings
GetAtomNameA
EnterCriticalSection
GetStartupInfoA
GetCurrentThreadId
FreeEnvironmentStringsA
SetHandleCount
GetStringTypeExA
GetOEMCP
GetWindowsDirectoryA
SetStdHandle
HeapReAlloc
HeapFree
InterlockedDecrement
EnumResourceLanguagesW
GetSystemTimeAsFileTime
GetLocalTime
CloseHandle
InterlockedExchange
InitializeCriticalSection
OpenMutexA
GetModuleHandleA
GetTickCount
GetEnvironmentStringsW
GetACP
InterlockedIncrement
RemoveDirectoryA
SetLastError
SetEnvironmentVariableA
TlsGetValue
GetLastError
WriteFile
GetStringTypeW
GetCommandLineA
SetFilePointer
HeapDestroy
GetStdHandle
GetExitCodeProcess
LeaveCriticalSection
TlsAlloc
GetStringTypeA
TlsFree
WideCharToMultiByte
TerminateProcess
CompareStringA
HeapCreate
RtlUnwind
CompareStringW
LoadLibraryA
OpenMutexW
QueryPerformanceCounter
VirtualQuery
VirtualAlloc
LCMapStringW
ReadFile
UnhandledExceptionFilter
DeleteCriticalSection
GetTimeZoneInformation
lstrcmpiW
LCMapStringA
GetSystemTime
GetModuleFileNameA
HeapAlloc
FlushFileBuffers
IsBadWritePtr

user32

RegisterClassA
IsZoomed
GetClipboardFormatNameA
GetMessageA
WINNLSGetIMEHotkey
DrawTextExA
SendNotifyMessageA
wsprintfA
GetNextDlgGroupItem
RegisterClassExA
GetProcessWindowStation
CharUpperBuffW
MonitorFromWindow

comctl32

InitCommonControlsEx

Sections

.text
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 314KB - Virtual size: 313KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dc286ea92893864bcf8c30a4d5b7be42

Headers

File Characteristics

Imports

kernel32

user32

comctl32

Sections

.text Size: 184KB - Virtual size: 183KB

.rdata Size: 4KB - Virtual size: 10KB

.data Size: 314KB - Virtual size: 313KB

.rsrc Size: 18KB - Virtual size: 18KB

.text
Size: 184KB - Virtual size: 183KB

.rdata
Size: 4KB - Virtual size: 10KB

.data
Size: 314KB - Virtual size: 313KB

.rsrc
Size: 18KB - Virtual size: 18KB