02783b858cd7155c316c5baf90728ea6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

02783b858cd7155c316c5baf90728ea6_JaffaCakes118
Size

423KB
MD5

02783b858cd7155c316c5baf90728ea6
SHA1

c4a2db52466c50b0d878f1c65e0dfdaa213fbcf3
SHA256

2b286aab779ce2967cd77604e0113fc05a168161a2a71838e72852c175a58a39
SHA512

45228fbfec56fcaaadf342867d74a144191083c932b82569406630e49b4c0ed4acfb48857c720ddba097e34b26cf3687eff8db589a6d317e1c26340dfcc681ff
SSDEEP

12288:2WNziYgBAV/X/bDoNAJwzGMy2ka0HNXdA1606:DziYga/vbeIwzGtHNK4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
02783b858cd7155c316c5baf90728ea6_JaffaCakes118

Files

02783b858cd7155c316c5baf90728ea6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

246601ca6d14e1c8ff64c8939773a592

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetDriveTypeW
GetCommTimeouts
OpenSemaphoreW
GetConsoleAliasExesLengthA
GetCurrentThread
ReadConsoleW
GetStartupInfoW
FreeEnvironmentStringsA
FillConsoleOutputCharacterW
Sleep
VirtualAlloc
DeleteFiber
UpdateResourceW
LoadLibraryA
SetConsoleFont
GetStartupInfoA
GetModuleHandleA
PeekNamedPipe
VirtualAllocEx
OutputDebugStringA
lstrcmpiW
GetConsoleTitleA
SetConsoleNumberOfCommandsW
FindClose
GetDiskFreeSpaceExA
ExitProcess
EnumResourceNamesW
HeapUnlock
GetSystemTime
GetTickCount
MoveFileExW
AddAtomA
FoldStringA
GetConsoleInputExeNameA
GlobalSize
VirtualFreeEx
VirtualFree
GenerateConsoleCtrlEvent
IsProcessorFeaturePresent
GetTimeZoneInformation
WriteConsoleA
lstrcatA
GetThreadSelectorEntry
lstrcpynW
GetNamedPipeHandleStateA
GlobalAddAtomA
TransactNamedPipe

user32

ClipCursor
GetClassInfoA
GetDlgItemTextA
DestroyIcon
DlgDirSelectExW
DragObject
CharNextA
DdeImpersonateClient
EndMenu
CreateCursor
CheckDlgButton
CreateCaret
ExitWindowsEx
FillRect
GetDlgItemInt
CreateWindowExA
FindWindowW
CopyIcon

msvcrt

fsetpos
_wexeclp
scanf
towlower
vfprintf
_wstati64
_wperror
_safe_fdivr
ctime
strncat
_execve
wcspbrk
_wpgmptr
tanh
_adjust_fdiv
_cputs
_wopen
_CxxThrowException
_umask
_wexecvpe
_strnicoll
_ismbcdigit
__lc_codepage
_setmbcp
_adj_fpatan
_mbctokata
__p__wpgmptr
_wspawnve
_wrename
_wexecvp
wcslen
mbstowcs
_strupr

comdlg32

ChooseColorA

shell32

SHFileOperationW
SHFileOperationA
ShellExecuteExW

ole32

OleCreateFromData
CreateDataCache
OleConvertIStorageToOLESTREAM
WriteStringStream
OleCreateEmbeddingHelper
SetDocumentBitStg

gdi32

GetWorldTransform
GetBitmapDimensionEx
OffsetRgn
GetCharWidthFloatW
ExtCreatePen
GetCurrentObject
PolyTextOutW
GetRandomRgn
FlattenPath
GetMetaRgn
TextOutW
PlayMetaFileRecord
IntersectClipRect
EndPath
GetRasterizerCaps
SetTextJustification
SetPolyFillMode
GdiPlayDCScript
CreateICW
OffsetWindowOrgEx

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.zeuc
Size: 310KB - Virtual size: 493KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gok
Size: 104KB - Virtual size: 466KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

246601ca6d14e1c8ff64c8939773a592

Headers

File Characteristics

Imports

kernel32

user32

msvcrt

comdlg32

shell32

ole32

gdi32

Sections

.text Size: 7KB - Virtual size: 7KB

.zeuc Size: 310KB - Virtual size: 493KB

.gok Size: 104KB - Virtual size: 466KB

.reloc Size: 1024B - Virtual size: 1KB

.text
Size: 7KB - Virtual size: 7KB

.zeuc
Size: 310KB - Virtual size: 493KB

.gok
Size: 104KB - Virtual size: 466KB

.reloc
Size: 1024B - Virtual size: 1KB