1bbcd533a8a2c198f153db0cd813ec6d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

1bbcd533a8a2c198f153db0cd813ec6d_JaffaCakes118
Size

160KB
MD5

1bbcd533a8a2c198f153db0cd813ec6d
SHA1

c2ebe87eed67d82793c440d46f204438b3f30147
SHA256

069498bb30761d9d2dfa42d1ae884a6674d1d23a9d9f9ba140064ff387356122
SHA512

60e9eb2895ecf13e00a92aa372384d8e4f9dc6d4c7458be0eef6dc484ea450b0fd56b65d21a38c63414256e94f0225a208f508fc05a15eb018aa99a03b9e8fcb
SSDEEP

1536:GubaSwwD1lfQfZ2c6gNZg5AVM30YZ8p+htJyGmZ1o/V0L45XTn/2hcp7Dm9FJDGR:rVfAekppItBmZ1o/VL5TnRiAogl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1bbcd533a8a2c198f153db0cd813ec6d_JaffaCakes118

Files

1bbcd533a8a2c198f153db0cd813ec6d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a90c02abb8e70055e03e9c555fc4eb35

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\source\fgdump\pstgdump\Debug\pstgdump.pdb

Imports

crypt32

CryptUnprotectData

kernel32

GetLocaleInfoA
SetStdHandle
GetLastError
CloseHandle
LoadLibraryA
GetProcAddress
lstrcpyA
FlushFileBuffers
LocalFree
lstrlenW
IsBadWritePtr
IsBadReadPtr
HeapValidate
RtlUnwind
TerminateProcess
GetCurrentProcess
ExitProcess
GetModuleHandleA
GetCommandLineA
GetVersionExA
RaiseException
HeapAlloc
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
GetModuleFileNameA
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
SetUnhandledExceptionFilter
VirtualQuery
InterlockedExchange
SetConsoleCtrlHandler
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcessHeap
FreeLibrary
IsBadCodePtr
SetFilePointer
LCMapStringA
LCMapStringW
VirtualProtect
GetSystemInfo

user32

wsprintfA
IsCharAlphaNumericA

advapi32

RegQueryValueExA
LogonUserA
ImpersonateLoggedOnUser
RevertToSelf
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey

oleaut32

VariantClear
CreateErrorInfo
SysFreeString
GetErrorInfo
VariantChangeType
VariantInit
SetErrorInfo

Sections

.textbss
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 128KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a90c02abb8e70055e03e9c555fc4eb35

Headers

File Characteristics

PDB Paths

Imports

crypt32

kernel32

user32

advapi32

oleaut32

Sections

.textbss Size: - Virtual size: 64KB

.text Size: 128KB - Virtual size: 124KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 8KB - Virtual size: 13KB

.idata Size: 4KB - Virtual size: 3KB

.textbss
Size: - Virtual size: 64KB

.text
Size: 128KB - Virtual size: 124KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 8KB - Virtual size: 13KB

.idata
Size: 4KB - Virtual size: 3KB