0a3d3c95b0a6d58cf88f00aeaf628577_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0a3d3c95b0a6d58cf88f00aeaf628577_JaffaCakes118
Size

58KB
MD5

0a3d3c95b0a6d58cf88f00aeaf628577
SHA1

65cffc4706a5e58759c3cd78e11f920ffb507276
SHA256

c9aec4a3c2214176161ea35ced9181d169bd4f77ed0be7f4c9706b5653a46f4c
SHA512

efc54cc9cde1d08d64013db4d64c7d4752bdbc400248c3154e2c0205c85d0509f281a60e146e90dc79e2cd5aa6ddfd98b5aa5e4b9e4f35c290043e40d8c3bc19
SSDEEP

768:eSD95tA1a9L2FzEO5XZd8t7mlgLoUjigvaoMvaLPzPPrHDtzkEMC78TgNJ:eSR5Aa9L2FzEO5XZ4MmtvbrXNwEGi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a3d3c95b0a6d58cf88f00aeaf628577_JaffaCakes118

Files

0a3d3c95b0a6d58cf88f00aeaf628577_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bd20bc5fca6f0c44ea9808ceaa365bf8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetOEMCP
OpenProcess
Sleep
MoveFileExA
GetTempPathA
CreateProcessA
SetProcessWorkingSetSize
WaitForSingleObject
GetShortPathNameA
WinExec
GetProcessId
GetTempFileNameA
GetBinaryTypeA
CloseHandle
RtlMoveMemory
GetModuleHandleA
ExitProcess
HeapReAlloc
HeapFree
IsBadReadPtr
GetTickCount
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
ReadFile
SetFilePointer
GetFileSize
CreateFileA
RtlFillMemory
HeapAlloc
GetProcessHeap
GetModuleFileNameA
IsDebuggerPresent
DeleteFileA
lstrlen
CreateMutexA
OpenMutexA
lstrcpynA

shlwapi

PathFileExistsA
PathFindFileNameA
PathRemoveFileSpecA

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyA

user32

wvsprintfA
FindWindowA
PostMessageA
ShowWindow
WaitForInputIdle
wsprintfA
MessageBoxA
GetWindowTextA
EnumChildWindows
GetAncestor
GetWindowThreadProcessId
EnumWindows

psapi

GetModuleFileNameExA
EnumProcesses

urlmon

URLDownloadToFileA

shell32

ShellExecuteEx
SHGetSpecialFolderPathA
SHFileOperationA

wininet

InternetOpenA
InternetCloseHandle
InternetOpenUrlA
InternetReadFile

iphlpapi

GetAdaptersInfo

msvcrt

_strnicmp
malloc
free
memmove
modf
strchr
_ftol
atoi
_CIfmod
??3@YAXPAX@Z
strncmp
strncpy
rand
srand
tolower
sprintf

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bd20bc5fca6f0c44ea9808ceaa365bf8

Headers

File Characteristics

Imports

kernel32

shlwapi

advapi32

user32

psapi

urlmon

shell32

wininet

iphlpapi

msvcrt

Sections

.text Size: 49KB - Virtual size: 49KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 5KB - Virtual size: 53KB

.text
Size: 49KB - Virtual size: 49KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 5KB - Virtual size: 53KB