3270b2f2f8fc693074a0d9b705053f07_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3270b2f2f8fc693074a0d9b705053f07_JaffaCakes118
Size

160KB
MD5

3270b2f2f8fc693074a0d9b705053f07
SHA1

0868b76ee55603433612a5906acccc7a9e82d176
SHA256

f62d7f7fc549f9db4d7b8ebc2d9f3800905b7cf7257c603fd1554e4affb6297c
SHA512

e69cbdb3facaf1205429f0fae46339c1f32d88d4becf9af27bdb9d572ec3ab850b137eb66c25ffb6624e113251b3b76494b56864bb272a8f424ab93401583256
SSDEEP

3072:PkJueGvAd3Rpfd5WNzmNLg/UeVgVDpYt5nx9tYY//0ja7J/Rto:HKhpFK4gMzu5J/AaO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3270b2f2f8fc693074a0d9b705053f07_JaffaCakes118

Files

3270b2f2f8fc693074a0d9b705053f07_JaffaCakes118
.exe windows:4 windows x86 arch:x86

09e801ab88c6d72de142017384343943

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueA
GetFileVersionInfoA

user32

GetSysColorBrush
DestroyWindow
TranslateMessage
CharToOemA
SetTimer
FindWindowA
SendMessageA
MessageBoxA
GetMessageA
IsDialogMessageA
RegisterWindowMessageA
LoadCursorA
DispatchMessageA
RegisterClassA
CreateWindowExA
PostMessageA
CreatePopupMenu
AppendMenuA
GetCursorPos
SetForegroundWindow
TrackPopupMenu
DestroyMenu
PostQuitMessage
DefWindowProcA
LoadIconA
wsprintfA
IsWindow

kernel32

CreateEventA
GetStringTypeA
GetStringTypeW
RtlUnwind
SetEvent
WriteFile
GetFileType
GetStdHandle
SetHandleCount
GetOEMCP
GetACP
GetCPInfo
WideCharToMultiByte
ReadProcessMemory
CloseHandle
OpenProcess
GetProcAddress
GetModuleHandleA
HeapAlloc
HeapFree
TerminateThread
GetCurrentThread
LoadLibraryA
WaitForSingleObject
CreateThread
DeviceIoControl
CreateFileA
DefineDosDeviceA
FreeLibrary
GetLastError
FreeEnvironmentStringsA
CreateProcessA
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameA
ExitProcess
OpenEventA
FreeEnvironmentStringsW
GetCommandLineA
GetVersion
GetProcessHeap
GetShortPathNameA
GetFileAttributesA
CreateDirectoryA
GetEnvironmentStringsW
GetStartupInfoA
GetEnvironmentStrings
HeapCreate
MultiByteToWideChar
LCMapStringA
LCMapStringW
HeapDestroy
VirtualFree
VirtualAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter

advapi32

SetServiceStatus
StartServiceA
OpenSCManagerA
OpenServiceA
QueryServiceStatus
CloseServiceHandle
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
OpenProcessToken
RegEnumValueA
RegEnumKeyExA
RegOpenKeyA
RegQueryValueExA

shell32

Shell_NotifyIconA

wsock32

WSACleanup
WSAStartup

Exports

Exports

CloseOutpostUI
DnscacheGetHostByAddr
DnscacheGetHostByName
ExitOutpost
OutpostGetLocalIpAddresses
OutpostGetProcessCmdLine
OutpostHideIcon
OutpostIsIpAddressLocal
OutpostSetMinidumpVersion
OutpostSetTrayIcon
OutpostShowIcon
VFILT_BindSetGet
VFILT_EnableDisableBind
VFILT_IoControl
VFILT_LoadPlugIn
VFILT_PlugInControl
__DnscacheGetA
__DnscacheGetPTR

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

09e801ab88c6d72de142017384343943

Headers

File Characteristics

Imports

version

user32

kernel32

advapi32

shell32

wsock32

Exports

Exports

Sections

.text Size: 39KB - Virtual size: 38KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 11KB - Virtual size: 14KB

.rsrc Size: 10KB - Virtual size: 10KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 39KB - Virtual size: 38KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 11KB - Virtual size: 14KB

.rsrc
Size: 10KB - Virtual size: 10KB

.reloc
Size: 3KB - Virtual size: 2KB