153dc8a0b14c9cb68233c103f5c908be_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

153dc8a0b14c9cb68233c103f5c908be_JaffaCakes118
Size

628KB
MD5

153dc8a0b14c9cb68233c103f5c908be
SHA1

e8e2eeeac9c296b4f71908ae681b6933d2d6cb99
SHA256

105f35113094e190e2a2196b932d1aeb132576388a15e454e74a31ff6d988f97
SHA512

3e63d45957cf42aa5383ebef4829ba8c6d3c332c73424c27d7bf7e70498b52203fb955b3878fee22beb12ecc5ba3ecda3319f9f1063d983a27ee3e2efb19468e
SSDEEP

3072:regeKp2OoE/CrsZGhET7HtOVGAxht6o0xlGfFcXmG3eAy2NMRXk:ygeSoE/EyqkoHX0xlGdcXfyBRXk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
153dc8a0b14c9cb68233c103f5c908be_JaffaCakes118

Files

153dc8a0b14c9cb68233c103f5c908be_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cdf1ae6d4b0e308c5361cabb04f19bd9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\My_MSN\Tasks\2007\Q4\-!originalsourcen von MSN - nicht l¤schen !-\autosearch\release\autosearch.pdb

Imports

comctl32

ord17

kernel32

FindResourceA
LoadResource
LockResource
SizeofResource
SetEndOfFile
CreateDirectoryA
GetConsoleOutputCP
WriteConsoleA
HeapSize
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetFileAttributesA
InterlockedDecrement
InterlockedIncrement
TerminateProcess
CloseHandle
OpenProcess
FreeLibrary
LoadLibraryA
FindClose
FindNextFileA
FindFirstFileA
WriteConsoleW
LCMapStringW
LCMapStringA
FlushFileBuffers
SetStdHandle
ReadFile
CreateFileA
MultiByteToWideChar
SetFilePointer
GetLastError
HeapFree
HeapAlloc
GetCommandLineA
GetVersionExA
GetProcessHeap
GetStartupInfoA
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
RtlUnwind
SetHandleCount
GetStdHandle
GetFileType
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
RaiseException
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSection
Sleep

user32

EndDialog
MessageBoxA
ShowWindow
SendMessageA
PostMessageA
SetWindowTextA
LoadBitmapA
FindWindowA
CreateWindowExA
EnumWindows
GetWindowTextA
GetClassNameA
GetSystemMetrics
LoadImageA
GetWindowThreadProcessId
DialogBoxParamA

gdi32

GetStockObject
SetBkMode
DeleteObject
CreateFontA

advapi32

RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegEnumKeyExA
RegCloseKey
RegSetValueExA

shell32

ShellExecuteA

ole32

CoUninitialize
CoInitialize
CLSIDFromProgID
CoCreateInstance

oleaut32

SysFreeString
SysAllocString

Sections

.text
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.srdata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cdf1ae6d4b0e308c5361cabb04f19bd9

Headers

File Characteristics

PDB Paths

Imports

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 60KB - Virtual size: 58KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 8KB - Virtual size: 11KB

.rsrc Size: 2.4MB - Virtual size: 2.4MB

.srdata Size: 72KB - Virtual size: 72KB

.text
Size: 60KB - Virtual size: 58KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 8KB - Virtual size: 11KB

.rsrc
Size: 2.4MB - Virtual size: 2.4MB

.srdata
Size: 72KB - Virtual size: 72KB