2fe7e3b2065d92553f7995f0243e3327_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2fe7e3b2065d92553f7995f0243e3327_JaffaCakes118
Size

135KB
MD5

2fe7e3b2065d92553f7995f0243e3327
SHA1

9fd7aa32519fcc755e116ef5ea8f203f1defe3b1
SHA256

2674bbaf99049c2f4ff60ca2257c5db15d415eb7cfd8739cdb488030143853ab
SHA512

259a6b48c0b64eb858520357427c02b33efae04b7aaac2271b0505e83b3da072e7215d76c7daa52a600c8875703556ccf46eacb7a762d371365bd7afdcdbdda8
SSDEEP

3072:fDzDECAFIabYsbvWeVQg2rtTTBfhitnH3eqSKWmYIoJw0:LzANds0v9QjdTB5itH31Wmwe0

Score

1^/10

Malware Config

Signatures

Files

2fe7e3b2065d92553f7995f0243e3327_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5ea0217ad0d4b62af1bf65b6490815b4

Code Sign

4e:37:ff:08:38:ec:0a:47:b2:7a:66:e0:4c:c8:62:b9
Certificate

Issuer

CN=Root Agency

Not Before

31/12/2007, 16:00

Not After

31/12/2094, 16:00

Subject

CN=Microsoft

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteProcessMemory
VirtualAllocEx
lstrlenW
OpenProcess
lstrcatW
ExpandEnvironmentStringsW
lstrcatA
CreateRemoteThread
CreateProcessA
CopyFileA
GetLastError
GetSystemDirectoryA
GetWindowsDirectoryA
GetProcAddress
Process32Next
Process32First
CreateToolhelp32Snapshot
lstrcpyA
lstrlenA
GetModuleFileNameA
GetModuleHandleA
FindResourceA
DeleteFileA
LoadResource
SizeofResource
CreateFileA
WriteFile
CloseHandle
FreeResource
ExpandEnvironmentStringsA
GetStartupInfoA

advapi32

RegOpenKeyA
ControlService
OpenServiceA
StartServiceA
CreateServiceA
EnumServicesStatusExA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyA
RegSetValueExA
RegCloseKey
OpenSCManagerA
CloseServiceHandle

shell32

ord680

msvcrt

strlen
__CxxFrameHandler
memset
_except_handler3
strncpy
_mbsrchr
strcmp
strcat
strncmp
free
fclose
fopen
strcpy
malloc
fwrite
_stricmp
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5ea0217ad0d4b62af1bf65b6490815b4

Code Sign

4e:37:ff:08:38:ec:0a:47:b2:7a:66:e0:4c:c8:62:b9Certificate

Signer

Headers

File Characteristics

Imports

kernel32

advapi32

shell32

msvcrt

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 1024B - Virtual size: 696B

.rsrc Size: 127KB - Virtual size: 126KB

4e:37:ff:08:38:ec:0a:47:b2:7a:66:e0:4c:c8:62:b9
Certificate

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1024B - Virtual size: 696B

.rsrc
Size: 127KB - Virtual size: 126KB