0e8d6916c36830599e699cb201793e8b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0e8d6916c36830599e699cb201793e8b_JaffaCakes118
Size

536KB
MD5

0e8d6916c36830599e699cb201793e8b
SHA1

ee95e3b8275e720bda09b6a44a63a0a2c7cc42fc
SHA256

3fc8672a18b5bc39edf27798730bfab8433b757ac4adc1a6ae8a5f224149465a
SHA512

1a4aef9ed41e16d70aff556f328fba311f04cd33f6bda5103b9ca386551b65fede8f870e4dd3355f89608b41e7b0e587b8fb515fa0ca551734ab08abb896d8c8
SSDEEP

12288:P7fnrKHqfR0zMYRCik9IzMnLNIFT0oH8G8lth0QavtsKharB:Tfr950zMYRJk9UkIFT0oCdgmKho

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e8d6916c36830599e699cb201793e8b_JaffaCakes118

Files

0e8d6916c36830599e699cb201793e8b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

321027e8bda853ae8919315889eb027f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

InitCommonControlsEx

wininet

InternetTimeToSystemTimeA
FtpRenameFileA
InternetSetDialState
GopherGetAttributeA
InternetGetLastResponseInfoA

kernel32

ExitProcess
VirtualProtectEx
LCMapStringW
FormatMessageW
GetEnvironmentStrings
TlsSetValue
GetTickCount
DosDateTimeToFileTime
HeapDestroy
CompareStringA
GetModuleHandleA
GetLocaleInfoA
TlsFree
HeapReAlloc
GetACP
HeapAlloc
GetCommandLineW
GetStdHandle
VirtualFree
FreeEnvironmentStringsA
GetModuleFileNameW
QueryPerformanceCounter
SetHandleCount
GetCurrentThreadId
IsValidLocale
MultiByteToWideChar
SetFilePointer
SetTimeZoneInformation
GetStringTypeA
HeapCreate
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetLocaleInfoW
GetCPInfo
TerminateProcess
IsBadWritePtr
SetLastError
ReadFile
RtlUnwind
GetStringTypeW
VirtualProtect
GetDateFormatA
GetCurrentProcess
SetEnvironmentVariableA
LeaveCriticalSection
HeapSize
EnumCalendarInfoExA
GetFileType
LoadLibraryA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetLastError
WriteFile
InitializeCriticalSection
TlsGetValue
GetStartupInfoW
EnterCriticalSection
InterlockedExchange
GetCurrentProcessId
GetModuleFileNameA
WideCharToMultiByte
GetProcAddress
GetCurrentThread
HeapFree
GetTimeZoneInformation
GetStartupInfoA
DeleteCriticalSection
FlushFileBuffers
GetOEMCP
GetEnvironmentStringsW
EnumSystemLocalesA
VirtualAlloc
GetSystemInfo
OpenMutexA
GetCommandLineA
CloseHandle
GetProcAddress
CreateMutexA
VirtualQuery
GetTimeFormatA
GetVersionExA
GetConsoleCursorInfo
TlsAlloc
LCMapStringA
IsValidCodePage
CompareStringW
SetStdHandle

user32

EndDeferWindowPos
SetRect
DrawStateW
PostMessageA
RegisterClassExA
RegisterClassA
OpenInputDesktop
SwapMouseButton
OpenIcon
CallNextHookEx
EnumWindows
TrackPopupMenu
ToUnicode
GetClassInfoExW

Sections

.text
Size: 205KB - Virtual size: 205KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 314KB - Virtual size: 313KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

321027e8bda853ae8919315889eb027f

Headers

File Characteristics

Imports

comctl32

wininet

kernel32

user32

Sections

.text Size: 205KB - Virtual size: 205KB

.rdata Size: 8KB - Virtual size: 17KB

.data Size: 314KB - Virtual size: 313KB

.rsrc Size: 7KB - Virtual size: 7KB

.text
Size: 205KB - Virtual size: 205KB

.rdata
Size: 8KB - Virtual size: 17KB

.data
Size: 314KB - Virtual size: 313KB

.rsrc
Size: 7KB - Virtual size: 7KB