18c49d4db8ae6f9760d218c4f16cedd4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

18c49d4db8ae6f9760d218c4f16cedd4_JaffaCakes118
Size

162KB
MD5

18c49d4db8ae6f9760d218c4f16cedd4
SHA1

95e5d8c89ab0423773a312edccf9c0673ef79e51
SHA256

d38565c9abc682c8756f8c8e994b786154eefdaf2491febca7d39df5140016d7
SHA512

f822bcfb41d525f0ce1a8278dc0b61bf42d25c6317fbdbebea3825de69285531db350db79c2bc419a5bc23856842007f31a8f55381c23cd4a027453d3f35ebf0
SSDEEP

1536:CIGE+kyHm6fMHmeGC8MHGfPEocNUGYqSuVoRqcf4nrQTO/wX0ZFXXXV57eo4n9Cn:QkggHnKftcRY/OoEBpYyXD6o4n9Cn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18c49d4db8ae6f9760d218c4f16cedd4_JaffaCakes118

Files

18c49d4db8ae6f9760d218c4f16cedd4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

350e61d8b4cf87de20e53cb942a80074

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
GetTempPathA
GetWindowsDirectoryA
GetSystemDirectoryA
SetCurrentDirectoryA
GetCurrentDirectoryA
UnmapViewOfFile
ExitProcess
GetFileTime
CreateFileA
GetCommandLineA
CreateThread
GlobalFree
GlobalAlloc
WritePrivateProfileStringA
GetComputerNameA
TerminateProcess
OpenProcess
CreateDirectoryA
LoadLibraryA
FreeLibrary
LoadResource
SizeofResource
GetModuleFileNameA
CreateProcessA
GetSystemTimeAsFileTime
SetEnvironmentVariableA
CompareStringW
CompareStringA
LCMapStringW
LCMapStringA
SetEndOfFile
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
FlushFileBuffers
GetFileType
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
lstrlenA
GetTickCount
DeleteFileA
GetModuleHandleA
GetProcAddress
GetCurrentProcessId
CreateSemaphoreA
GetLastError
FindResourceA
SetStdHandle
RtlUnwind
CloseHandle
FindFirstFileA
SetHandleCount
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
WideCharToMultiByte
WriteFile
SetFilePointer
GetTimeZoneInformation
FileTimeToLocalFileTime
HeapSize
GetCurrentProcess
ReadFile
GetStdHandle
FindNextFileA
FindClose
FileTimeToSystemTime
HeapAlloc
HeapReAlloc
GetSystemTime
GetLocalTime
GetStartupInfoA
GetVersion
HeapFree

advapi32

RegQueryInfoKeyA
RegEnumValueA
GetUserNameA
RegQueryValueExA
RegDeleteValueA
RegOpenKeyA
RegSetValueExA
RegCloseKey

gdi32

GetStockObject

mpr

WNetOpenEnumA
WNetEnumResourceA
WNetCloseEnum

shell32

SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation

user32

EnumWindows
PostMessageA
DispatchMessageA
TranslateMessage
GetMessageA
RegisterClassA
LoadCursorA
LoadIconA
UpdateWindow
ShowWindow
CreateWindowExA
IsWindow
GetWindowTextLengthA
GetWindowTextA
GetWindowLongA
DefWindowProcA
FindWindowA
SendMessageA
MessageBoxA
PostQuitMessage
SetTimer
KillTimer

wsock32

WSACleanup
gethostname
WSAStartup
closesocket
connect
htons
socket
gethostbyname
send
recv

Sections

code
Size: 156KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avp
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

350e61d8b4cf87de20e53cb942a80074

Headers

File Characteristics

Imports

kernel32

advapi32

gdi32

mpr

shell32

user32

wsock32

Sections

code Size: 156KB - Virtual size: 156KB

.rsrc Size: 1KB - Virtual size: 4KB

.avp Size: 3KB - Virtual size: 4KB

code
Size: 156KB - Virtual size: 156KB

.rsrc
Size: 1KB - Virtual size: 4KB

.avp
Size: 3KB - Virtual size: 4KB