27b9de2fca97b1b7e996a4477e304388_JaffaCakes118

General

Target

27b9de2fca97b1b7e996a4477e304388_JaffaCakes118
Size

47KB
MD5

27b9de2fca97b1b7e996a4477e304388
SHA1

48bd205cb766401a3b95cb1994dc372084ab5217
SHA256

f82516292aab89b61955b7628bf5d42c0cea1a66f0e693a4d656b7dffcc0e554
SHA512

2eb9559bf128653b83598f89442644fb48810ccd2371137a992fbcebec8eef6e37aa8c9ca7f49cf1462b21cac7210befa9bd9bbdef756cb0495f5365b5da8221
SSDEEP

768:dTgpHnP/58ByHA/oEraNs1HPP+JIKNMVfb+u:tgt358KAAErOwPyIK2qu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27b9de2fca97b1b7e996a4477e304388_JaffaCakes118

Files

27b9de2fca97b1b7e996a4477e304388_JaffaCakes118
.exe .vbs windows:4 windows x86 arch:x86 polyglot

4b88900ea6b5b8a75bcc932764801301

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WinExec
CreateDirectoryA
GetModuleFileNameA
GetWindowsDirectoryA
lstrcmpiA
lstrcpyA
lstrcmpA
FindClose
DeleteFileA
FindNextFileA
FindFirstFileA
lstrcatA
GetLogicalDriveStringsA
GetVolumeInformationA
GetDriveTypeA
GetLogicalDrives
SetFileAttributesA
MoveFileA
GetFileAttributesA
WritePrivateProfileStringA
CreateToolhelp32Snapshot
GetSystemDirectoryA
GetProcAddress
LoadLibraryA
GetLocalTime
GetTempPathA
ExpandEnvironmentStringsA
FreeLibrary
GetVersionExA
UnmapViewOfFile
MapViewOfFile
ExitProcess
SetUnhandledExceptionFilter
lstrlenA
WriteFile
LockResource
CreateFileA
LoadResource
SizeofResource
FindResourceA
Process32First
Process32Next
OpenProcess
TerminateProcess
CreateMutexA
GetLastError
CloseHandle
CreateThread
CopyFileA
Sleep

user32

wsprintfA
FindWindowExA
keybd_event
IsWindow
SendMessageA
EnumChildWindows
GetForegroundWindow
GetWindowLongA
GetClassNameA
PostMessageA
GetCursorPos
WindowFromPoint
GetWindowTextA
MessageBoxA
GetParent

advapi32

RegCloseKey
RegCreateKeyA
RegSetValueExA
RegSetValueA
RegDeleteKeyA

msvcrt

_initterm
__getmainargs
__p___initenv
_XcptFilter
_exit
fgets
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__setusermatherr
??2@YAPAXI@Z
fclose
fwrite
fread
fopen
exit
fputs
sprintf
_access
strstr
printf
fseek
rand
srand
time

wininet

InternetOpenUrlA
InternetOpenA
InternetCloseHandle

ws2_32

gethostbyname
gethostname
WSACleanup
WSAStartup

Sections

.data
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4b88900ea6b5b8a75bcc932764801301

Headers

File Characteristics

Imports

kernel32

user32

advapi32

msvcrt

wininet

ws2_32

Sections

.data Size: 30KB - Virtual size: 30KB

.rsrc Size: 16KB - Virtual size: 15KB

.data
Size: 30KB - Virtual size: 30KB

.rsrc
Size: 16KB - Virtual size: 15KB