28948410d338e3736567cb419eb56332_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

28948410d338e3736567cb419eb56332_JaffaCakes118
Size

152KB
MD5

28948410d338e3736567cb419eb56332
SHA1

28a046c3670dbc7ecf82dc96913df4b85ed82698
SHA256

1425e8c5f388a17aa44c15876e93f968308ca08ce8f9bb8952b3aceb57b0969c
SHA512

40994c1a9f63c48196c965795a5ff628f2d5a68b0f756c594e8421dee68f019dd8f1dcf716a15f457e12531bcb3f432986c794da5df5b8d7293be039439c4e4f
SSDEEP

3072:u9ACAGynuOptRm7vyPs80JRtLxA9StgsAR/GkvG:AP2nm7vu0JfxAKgsAMke

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28948410d338e3736567cb419eb56332_JaffaCakes118

Files

28948410d338e3736567cb419eb56332_JaffaCakes118
.exe windows:4 windows x86 arch:x86

837ea2a29048532ca8f6d48a285e3c7a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreatePipe
SetUnhandledExceptionFilter
SetErrorMode
DuplicateHandle
OpenMutexA
CreateMutexA
ReleaseMutex
GetTimeFormatA
InterlockedExchange
GetVolumeInformationA
GetCurrentProcessId
GetFileTime
GetModuleFileNameA
FindCloseChangeNotification
HeapCreate
HeapFree
HeapAlloc
SetFileAttributesA
GetFileAttributesA
GetVersionExA
GetProfileStringW
Process32Next
Process32First
CloseHandle
CreateToolhelp32Snapshot
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetFilePointer
FlushFileBuffers
GetLastError
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
WriteFile
GetEnvironmentVariableA
PeekNamedPipe
GetCurrentThread
GetCurrentProcess
lstrcmpA
RtlUnwind
GetFileType
GetStdHandle
SetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapReAlloc
VirtualAlloc
VirtualFree
HeapDestroy
GetVersion
GetCommandLineA
GetStartupInfoA
ExitProcess
TerminateProcess
GetSystemTimeAsFileTime
GetModuleHandleA

winspool.drv

EnumPrintersA
ClosePrinter
DocumentPropertiesA
OpenPrinterA

shlwapi

PathStripToRootA
PathIsRootA
PathCanonicalizeA

ole32

CoInitialize
CoRevokeClassObject
CoTaskMemFree
CoTaskMemAlloc

comctl32

ImageList_DragEnter
ImageList_DragLeave
ImageList_Draw
ImageList_ReplaceIcon

wininet

InternetWriteFile
InternetSetOptionA
InternetReadFile
InternetQueryOptionA
InternetQueryDataAvailable
InternetOpenA
HttpEndRequestA
InternetErrorDlg
InternetCrackUrlA
InternetConnectA
InternetCloseHandle
HttpQueryInfoA
HttpOpenRequestA
HttpAddRequestHeadersA
InternetAttemptConnect
HttpSendRequestExA
InternetGetCookieA
HttpSendRequestA

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

837ea2a29048532ca8f6d48a285e3c7a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

winspool.drv

shlwapi

ole32

comctl32

wininet

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 68KB - Virtual size: 66KB

.data Size: 40KB - Virtual size: 320KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 68KB - Virtual size: 66KB

.data
Size: 40KB - Virtual size: 320KB

.rsrc
Size: 4KB - Virtual size: 1KB