1019471dcf8e861347abb166511df4f5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

1019471dcf8e861347abb166511df4f5_JaffaCakes118
Size

128KB
MD5

1019471dcf8e861347abb166511df4f5
SHA1

dcd8c793ed1dea2da494e781b7e6cebf5ba2d360
SHA256

dee95b6f7e4a7afb70fbf430cd0dd642e031885a7cdf1592d17772ca87aa017b
SHA512

52919ea0fb135ae30317f685253f54513d3543164dc87febe21a9f10c489c8163074c3f47cf83eff5937da7e6e370e6d03173f382bdeccb1179ad56bb8543073
SSDEEP

1536:pucAouuxiXVO138Dlc/etBZKB5b5xCKjOxAmXCu2QlAQOw8bi6eYKFjciRUH:M9VO138Dlc/sZMjjj6dYQOweZ3EjciY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1019471dcf8e861347abb166511df4f5_JaffaCakes118

Files

1019471dcf8e861347abb166511df4f5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ee710a65056e7dd9642e474117e73a20

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteW

zlib

ord63
ord66
ord64
ord67
ord68
ord61
ord80
ord81
ord82
ord83
ord84
ord72

mfc80u

ord774
ord280
ord3990
ord2261
ord1479
ord282
ord6700
ord745
ord557
ord1176
ord2460
ord2282
ord287
ord631
ord1431
ord2745
ord3925
ord2279
ord2271
ord386
ord5711
ord2444
ord265
ord6111
ord1472
ord899
ord283
ord760
ord1064
ord4098
ord572
ord4026
ord1110
ord1079
ord776
ord870
ord5398
ord293
ord2895
ord577
ord764
ord5558

msvcr80

malloc
fwrite
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
fopen
fread
feof
fclose
free
__CxxFrameHandler3
_wsplitpath

kernel32

SetUnhandledExceptionFilter
QueryPerformanceCounter
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
CreateDirectoryW
GetUserDefaultLangID
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoW
GetTempPathW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

oleaut32

SysFreeString

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ee710a65056e7dd9642e474117e73a20

Headers

File Characteristics

Imports

shell32

zlib

mfc80u

msvcr80

kernel32

advapi32

oleaut32

Sections

.text Size: 35KB - Virtual size: 35KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 3KB - Virtual size: 3KB

.rsrc Size: 72KB - Virtual size: 76KB

.text
Size: 35KB - Virtual size: 35KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 72KB - Virtual size: 76KB