1bba25806c52c444a07447586c29b0cf_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

1bba25806c52c444a07447586c29b0cf_JaffaCakes118
Size

435KB
MD5

1bba25806c52c444a07447586c29b0cf
SHA1

c849e21c907a77d72490ffc7f207281a27fd0fad
SHA256

ffaa3da44b325a412742af3b0c4f45a32d02510d772ee9d856a899b90236338b
SHA512

c31e699ed1d6c3277c44a937d35257d92e286d9a76c2fadf71709eb67959800bc7b46cf903d44fbf814cc9e18c4401396b4ddfedf4560c1a91d4773d248d3520
SSDEEP

12288:M+Ku4C6gDfqJbNtPiAHBqpuIBRRD5PYzBstRYl1NV/w:z1pcLP5HBqpuIBj5JtRwHV4

Score

1^/10

Malware Config

Signatures

Files

1bba25806c52c444a07447586c29b0cf_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3aab0d6ea4281b0fd9e344925f4e6817

Code Sign

13:8f:91:e5:7f:47:bd:4b:b5:8b:af:38:8a:16:ff:2f
Certificate

Issuer

CN=weaehixqqwp

Not Before

06/01/2012, 16:31

Not After

10/08/2018, 22:00

Subject

CN=Hernolu

3a:10:b2:bf:3d:04:5a:8b:e5:3a:72:63:b5:d6:06:8d:b8:e4:d6:79
Signer

Actual PE Digest

3a:10:b2:bf:3d:04:5a:8b:e5:3a:72:63:b5:d6:06:8d:b8:e4:d6:79

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

OleConvertOLESTREAMToIStorage

oleaut32

CreateErrorInfo

kernel32

GetCurrentThreadId
GetStringTypeA
LCMapStringW
LCMapStringA
GetStartupInfoA
TlsGetValue
GetCommandLineA
TlsSetValue
GetFileType
GetModuleHandleA
VirtualAlloc
GetProcAddress
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetStringTypeW
TlsAlloc
SetLastError
GetLastError
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
HeapReAlloc
LoadLibraryA
MultiByteToWideChar

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gmak
Size: 271KB - Virtual size: 270KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.yhmi
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3aab0d6ea4281b0fd9e344925f4e6817

Code Sign

13:8f:91:e5:7f:47:bd:4b:b5:8b:af:38:8a:16:ff:2fCertificate

3a:10:b2:bf:3d:04:5a:8b:e5:3a:72:63:b5:d6:06:8d:b8:e4:d6:79Signer

Headers

File Characteristics

Imports

ole32

oleaut32

kernel32

Sections

.text Size: 19KB - Virtual size: 18KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 1KB - Virtual size: 92KB

.gmak Size: 271KB - Virtual size: 270KB

.yhmi Size: 131KB - Virtual size: 131KB

.rsrc Size: 5KB - Virtual size: 5KB

.reloc Size: 3KB - Virtual size: 2KB

13:8f:91:e5:7f:47:bd:4b:b5:8b:af:38:8a:16:ff:2f
Certificate

3a:10:b2:bf:3d:04:5a:8b:e5:3a:72:63:b5:d6:06:8d:b8:e4:d6:79
Signer

.text
Size: 19KB - Virtual size: 18KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1KB - Virtual size: 92KB

.gmak
Size: 271KB - Virtual size: 270KB

.yhmi
Size: 131KB - Virtual size: 131KB

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 3KB - Virtual size: 2KB