2d17aa5d68ca16353662fd244c3fb24d_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

2d17aa5d68ca16353662fd244c3fb24d_JaffaCakes118
Size

178KB
MD5

2d17aa5d68ca16353662fd244c3fb24d
SHA1

0413bc0553c56319300ec81e80a94a9ec7487df2
SHA256

24c867c60fb52e549e27cf0f38df7e0a08b8731aa903b17405b0541884567e36
SHA512

cec136a9a7198972f5030e14ad175b569b430be527d087b63610a2fcc585783c187e56b22b55bae1c20dbfa8f0089504c8173cd3816819e967e2275e43a9983d
SSDEEP

3072:k+RzCjMOwOWrRoNaJAYC1iINkC4u0HvNiBkoCVyMg0+Inam0SB/OJDH8brYumT7:kqXOWrBAf1iWSvOkoPTyBiDar+7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2d17aa5d68ca16353662fd244c3fb24d_JaffaCakes118

Files

2d17aa5d68ca16353662fd244c3fb24d_JaffaCakes118
.exe windows:0 windows x86 arch:x86

d86b390f38a11fdc84852a2ab22fb716

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

atl

ord23
ord16
ord57
ord20
ord32
ord21
ord17
ord11
ord18
ord10

kernel32

GlobalMemoryStatusEx
SetConsoleKeyShortcuts
SetStdHandle
ExitProcess
GetCurrentProcess
GetCommandLineW
WaitForSingleObject
HeapDestroy
RegisterWaitForInputIdle
GetCommandLineA
GetStdHandle
ContinueDebugEvent
SetEvent
MultiByteToWideChar
TryEnterCriticalSection
RtlUnwind
GetLastError
VirtualAlloc
SetConsoleOutputCP
InterlockedIncrement
Heap32Next
HeapFree
ReadConsoleOutputCharacterA
GetStartupInfoW
SetProcessAffinityMask
GetStartupInfoA
IsSystemResumeAutomatic
BuildCommDCBW
GetConsoleInputWaitHandle
UpdateResourceA
SetEnvironmentVariableA
SetHandleCount
WriteConsoleOutputA
FindFirstChangeNotificationA
GetConsoleSelectionInfo
_hread
CloseHandle
AddConsoleAliasA
GetConsoleFontSize
GetVolumeInformationW
FileTimeToSystemTime
ReadFileScatter
GetDriveTypeA
EnumDateFormatsExW
SetThreadLocale
Sleep
FindActCtxSectionStringW
OpenWaitableTimerW
EnumDateFormatsA
GetVersionExA
GetLocaleInfoA
GetNativeSystemInfo
SetProcessShutdownParameters
InterlockedDecrement
HeapReAlloc
FreeEnvironmentStringsW
QueryPerformanceFrequency
PrivCopyFileExW
HeapAlloc
lstrcmpiW
HeapLock
FindActCtxSectionStringA
HeapCreate
SetDefaultCommConfigA
CreateWaitableTimerW
GetNumberOfConsoleFonts
UnhandledExceptionFilter
RtlFillMemory
CreateEventW
CallNamedPipeW
DeleteCriticalSection
GetEnvironmentStringsW
GetTempFileNameA
GetComputerNameExW
FreeEnvironmentStringsA
FindVolumeMountPointClose
GetFileType
LockFile
InitAtomTable
CompareStringA
VirtualFree
SetThreadAffinityMask
GetCurrentActCtx
GetStringTypeExW
RemoveDirectoryW

user32

DispatchMessageW
CharNextW
GetMessageW
PostThreadMessageW

ole32

CoUninitialize
CoSuspendClassObjects
CoInitializeSecurity
CoInitializeEx
CoResumeClassObjects

msdart

?sm_dblDfltSpinAdjFctr@CReaderWriterLock2@@1NA
MpHeapDestroy
MPCSUninitialize
MPInitializeCriticalSection
MPCSInitialize

msvcrt

_wsplitpath
strcspn
gets
_strdup
_wsearchenv
fmod
_getdrives
setvbuf
_execvp
_spawnv
_controlfp
_pipe
_isnan
_j1
_environ
_putws
_localtime64
abs
_wutime64
_execlp
fgetwc
_getcwd
_scprintf
strcpy
isalnum
_aligned_offset_realloc
_wgetcwd
strncpy
_fputchar
_heapadd
raise
_strnicoll
isxdigit
_mbscoll
_ismbcsymbol
_strcmpi
_isatty
__crtGetLocaleInfoW
_strerror
wcsncat
_set_error_mode
_snprintf
_wexeclp
___mb_cur_max_func
_fsopen
asctime
_wputenv
_wcsnicoll
_strnset
ungetwc
_pgmptr
_mbctohira
_getw
getchar
calloc
_eof
_lfind
_wfsopen
__set_app_type
_dstbias
_ismbbpunct
scanf
_wcsnicmp
_mbcjmstojis
toupper
_ismbbkalnum
_wstat
_utime64
_winver
__dllonexit
fabs
_isctype
wcsstr
_ismbbkana
_ctype
_wspawnv
_creat
_cprintf
__pxcptinfoptrs
_waccess
_yn
_mbsicmp
_sys_nerr
_commit
_wfindfirst64
_wunlink
_ismbbprint
iswalnum
memcmp
_itow
_msize
_vscwprintf
_iob
fgetws
_open_osfhandle
_tell
_getdiskfree
_putwch
__threadhandle
signal
_wsystem
atoi
_findnext
_mbstrlen
memmove
_seterrormode
_wspawnve
_wexecl
_mbsnccnt
_mbsninc
_i64toa
_wcstoui64
__iob_func
vswprintf
getwc
acos
wcstombs
_lrotr
fputs
_wtoi64
_wcsicmp
_wfindfirst
__crtGetStringTypeW
atof
_setjmp
_fstati64
__crtCompareStringA
clearerr
ferror
_set_sbh_threshold
_mbsrchr
_cgetws
_aligned_malloc
frexp
_getwch
_Getmonths
ispunct
??_7bad_typeid@@6B@
__fpecode
_wcstoi64
_strtime
fprintf
_winmajor
iswalpha
rename
_XcptFilter
_ismbcprint
isdigit
_getsystime
_fstat64
putwchar
_spawnvpe
_ctime64
_ismbcalpha
_fcvt
gmtime
wcscmp
_strset
_fileinfo
_ismbcspace
_heapused
_setmbcp
_clearfp
_strtoui64
_mbctoupper
_lseeki64
exit
_ltoa
ungetc
_rmdir
_CxxThrowException
atan
free
_ismbcl2
realloc
___setlc_active_func
strftime
_mbscspn
_ismbchira
_futime64
_ultow
_gmtime64
_timezone
_beep
wcsrchr
wcscpy
_sopen
qsort
_snscanf
_mbsncat
_mbctolower
mblen
_putenv
_filbuf
_wexecvpe
_mbsnicoll
wcspbrk
mbtowc
wcstol
_mbsicoll
__argc
_execlpe
_mbclen
_vscprintf
_dup
swscanf
__STRINGTOLD
_wgetenv
_get_osfhandle
_Strftime
strcmp
?set_unexpected@@YAP6AXXZP6AXXZ@Z
_cwprintf
fgetc
_wcserror
ftell
_mbctokata
fwrite
_strtoi64
_getws
bsearch
_cwscanf
__crtCompareStringW
_mbsnbcoll
_mbsnbcpy
sqrt
_endthread
__badioinfo
_wspawnlp
_vsnwprintf
_i64tow
_wfopen
_get_sbh_threshold
_wexecle
asin
__wgetmainargs
_strlwr
_mbsnicmp
_ui64tow
??_7bad_cast@@6B@
_finite
_wopen
_winminor
fwprintf
srand
iswxdigit
__unguarded_readlc_active
_wexecv
_cgets
_itoa
_wfindnexti64
wscanf
_execv
iswdigit
__wcserror
_beginthreadex
__winitenv
_fmode
__pctype_func
_sleep
_spawnvp
_acmdln
___lc_codepage_func
_atoi64
_memccpy
_mktemp
_findnext64
vprintf
_stat
_mbstok
_strrev
_wfindfirsti64
fputc
_sys_errlist
_ismbstrail
fputwc
_wctime
_wspawnle
wcscat
__unDName
_mbsrev
_mbsncoll
putchar
__doserrno
__lc_codepage
__RTtypeid
strcat
_chdrive
_lsearch
__pioinfo
_wasctime
_mbsinc
_wfdopen
sin
_ui64toa
_strdate
_chmod
__DestructExceptionObject
_exit
?_query_new_mode@@YAHXZ
atol
_mkdir
_fileno
_access
wcslen
_close
_telli64
_mbsnset
_wctime64
pow
iswgraph
strtol
_popen
_mbsnbicmp
__wargv
_execl
strtoul
atexit
_heapmin
_getche
_pclose
__argv
_mbsncpy
wprintf
_wstat64
_wstati64
fwscanf
_y0
fsetpos
_aligned_realloc
wcscoll
towlower
sscanf
_ftime64
__setusermatherr
_c_exit
__crtLCMapStringW
?_set_new_mode@@YAHH@Z
_ismbclower
_ismbbalpha
_osplatform
rand
_getdllprocaddr
_mbscmp
div
_flushall
_nextafter
_wmakepath
putc

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.zLVS
Size: 2KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.J
Size: 3KB - Virtual size: 49KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Cg
Size: 3KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.a
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.FgcE
Size: 1KB - Virtual size: 17KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.to
Size: 2KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.JhJe
Size: 3KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 123KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d86b390f38a11fdc84852a2ab22fb716

Headers

File Characteristics

Imports

atl

kernel32

user32

ole32

msdart

msvcrt

Sections

.text Size: 15KB - Virtual size: 14KB

.rdata Size: 10KB - Virtual size: 9KB

.zLVS Size: 2KB - Virtual size: 21KB

.J Size: 3KB - Virtual size: 49KB

.Cg Size: 3KB - Virtual size: 18KB

.data Size: 8KB - Virtual size: 38KB

.a Size: 1KB - Virtual size: 1KB

.FgcE Size: 1KB - Virtual size: 17KB

.to Size: 2KB - Virtual size: 15KB

.JhJe Size: 3KB - Virtual size: 24KB

.rsrc Size: 123KB - Virtual size: 152KB

.text
Size: 15KB - Virtual size: 14KB

.rdata
Size: 10KB - Virtual size: 9KB

.zLVS
Size: 2KB - Virtual size: 21KB

.J
Size: 3KB - Virtual size: 49KB

.Cg
Size: 3KB - Virtual size: 18KB

.data
Size: 8KB - Virtual size: 38KB

.a
Size: 1KB - Virtual size: 1KB

.FgcE
Size: 1KB - Virtual size: 17KB

.to
Size: 2KB - Virtual size: 15KB

.JhJe
Size: 3KB - Virtual size: 24KB

.rsrc
Size: 123KB - Virtual size: 152KB