1b7e12eb2153f7f13835547f42f88f3a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

1b7e12eb2153f7f13835547f42f88f3a_JaffaCakes118
Size

244KB
MD5

1b7e12eb2153f7f13835547f42f88f3a
SHA1

3d72c9195469e68c5a6f5952721234d3872c0645
SHA256

cdde56d2cf666803bbd55774db3cb94e6a5d3576511ef117bc46a1cbf5b74589
SHA512

b35df1490aea1bb24e935ed529ada961448d6f73d3f2d8999f1c39c6f1c77571f09be346230ef67355a960bcddc63403dd3e08764609a9561f041785a6fb37ce
SSDEEP

6144:cRcMylaEL551bsDJfy0ZwoNuCsbgvk1hioGKNRblE5LUGo9ha:cR7ylz5Isqu6kDXzzblEOGSa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b7e12eb2153f7f13835547f42f88f3a_JaffaCakes118

Files

1b7e12eb2153f7f13835547f42f88f3a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d2a424c85f3ca552d5fdea28e5516ea5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\ccview\kcho2_aseinstaller_view\ase_installers\utilities\pacman\release\PackageManager.pdb

Imports

kernel32

FileTimeToLocalFileTime
GetFileInformationByHandle
LocalFileTimeToFileTime
GetFileSize
FindResourceA
FreeLibrary
LoadResource
UpdateResourceA
WaitForSingleObject
WriteFile
SizeofResource
GetExitCodeProcess
CreateProcessA
ReadFile
CreateDirectoryA
FindFirstFileA
GetLastError
SetLastError
RemoveDirectoryA
CopyFileA
FindClose
LoadLibraryA
CloseHandle
BeginUpdateResourceA
GetModuleFileNameA
FindNextFileA
EndUpdateResourceA
DeleteFileA
SetEvent
CreateEventA
CreateThread
GetSystemDefaultLangID
EnumResourceLanguagesA
ConvertDefaultLocale
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoA
SetFileAttributesA
GetFileAttributesA
SetFileTime
CreateFileA
DosDateTimeToFileTime
LockResource
FileTimeToDosDateTime
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
HeapFree
HeapAlloc
MultiByteToWideChar
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetVersionExA
GetProcessHeap
GetStartupInfoA
RaiseException
RtlUnwind
Sleep
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetFileType
GetProcAddress
GetModuleHandleA
ExitProcess
GetStdHandle
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
SetHandleCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
GetCPInfo
GetACP
GetOEMCP
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSection
SetEndOfFile
FlushFileBuffers

user32

DialogBoxParamW
SendMessageA
GetDlgItem
EndDialog
LoadStringW
LoadImageA
SetDlgItemTextW
SetWindowTextW
MapDialogRect

gdi32

CreateFontA
SetBkMode
DeleteObject
GetStockObject
CreateSolidBrush
SetTextColor

shell32

SHCreateDirectoryExA

shlwapi

PathAppendA
PathRemoveFileSpecA
PathFindFileNameA
PathAddBackslashA
PathRelativePathToA

Sections

.text
Size: 128KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d2a424c85f3ca552d5fdea28e5516ea5

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

shlwapi

Sections

.text Size: 128KB - Virtual size: 125KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 8KB - Virtual size: 22KB

.rsrc Size: 2.5MB - Virtual size: 2.5MB

.text
Size: 128KB - Virtual size: 125KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 8KB - Virtual size: 22KB

.rsrc
Size: 2.5MB - Virtual size: 2.5MB