06b24f00f6a567c94be68d1c2a3e21b9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

06b24f00f6a567c94be68d1c2a3e21b9_JaffaCakes118
Size

51KB
MD5

06b24f00f6a567c94be68d1c2a3e21b9
SHA1

91d6f69b56f748805a5fa07f910b45eeb53c3f90
SHA256

9c1ed6b2af90320b66f7d290ddf6deee7d0f3f11983ee86d9a2dde35677faf79
SHA512

dccf7b1bd99f830d737a40e2f89f1f8468875308918917ef763ac53e81e1906d41d9343a72ebd763874a1c312fd242684fd9e7f3e511dca96ab471c422f4b068
SSDEEP

768:tHqg8+UAq4OwSRNFdv7QuhQ0KTM/0V6UHnt7PTAVkW0CzCABlNK08rDtJUlYwlC+:tHxjmK0KFeL0F9KPDjwRmtm0vnnqh+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06b24f00f6a567c94be68d1c2a3e21b9_JaffaCakes118

Files

06b24f00f6a567c94be68d1c2a3e21b9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4588f8c3557df46f5023b87e2e3d2e3a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
strcpy
fopen
strlen
fprintf
fclose
exit
toupper
_ftol
ceil
_endthread
strcmp
strncpy
_beginthread
atoi
??1type_info@@UAE@XZ
_CxxThrowException
strstr
srand
rand
_snprintf
memset
_vsnprintf
strncat

kernel32

LocalFree
GetSystemTime
GetFileSize
SetFilePointer
ReadFile
FreeLibrary
LoadLibraryA
GetProcAddress
WriteProcessMemory
CreateRemoteThread
DeleteFileA
GlobalAlloc
GlobalLock
GlobalUnlock
WinExec
GetComputerNameA
GetLocaleInfoA
GetTickCount
TerminateThread
Sleep
WaitForSingleObject
CreateMutexA
GetCurrentProcessId
ExitProcess
GetLastError
SetFileAttributesA
CopyFileA
GetSystemDirectoryA
GetModuleFileNameA
GetModuleHandleA
SetErrorMode
GetTempPathA
QueryPerformanceFrequency
QueryPerformanceCounter
GetVersionExA
GetFileAttributesA
SetProcessPriorityBoost
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
MoveFileExA
GetEnvironmentVariableA
GetShortPathNameA
lstrlenA
CloseHandle
WriteFile
CreateFileA
CreateDirectoryA
lstrcatA
GetDriveTypeA
GetLogicalDriveStringsA
lstrcmpiA
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
VirtualAllocEx

user32

MessageBoxA
SetClipboardData
CloseClipboard
FindWindowA
GetWindowThreadProcessId
EmptyClipboard
keybd_event
SetForegroundWindow
SetFocus
ShowWindow
VkKeyScanA
OpenClipboard
BlockInput

ws2_32

connect
send
socket
htons
recv
WSAStartup
closesocket
gethostbyname
inet_addr

wininet

InternetOpenUrlA
InternetOpenA
InternetReadFile

urlmon

URLDownloadToFileA

shell32

ShellExecuteExA
SHChangeNotify
ShellExecuteA

advapi32

RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey

ntdll

NtQuerySystemInformation
ZwSystemDebugControl

oleaut32

VariantClear
SysAllocString
VariantInit

ole32

CoUninitialize
CoCreateInstance
CoInitialize

shlwapi

SHDeleteKeyA

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4588f8c3557df46f5023b87e2e3d2e3a

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

ws2_32

wininet

urlmon

shell32

advapi32

ntdll

oleaut32

ole32

shlwapi

Sections

.text Size: 24KB - Virtual size: 23KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 22KB - Virtual size: 22KB

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 22KB - Virtual size: 22KB