3b0d0641ebbc5d226f9ea9a0dbc39b7a_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

3b0d0641ebbc5d226f9ea9a0dbc39b7a_JaffaCakes118
Size

204KB
MD5

3b0d0641ebbc5d226f9ea9a0dbc39b7a
SHA1

ce2d43286b58d72bc43b56a753185996a9613c90
SHA256

189e9b0afec7e70785753eb1e7dd1c01490ff89751e5686028b0827209b2c8b3
SHA512

ec62aff61ae3520ecfadb2d4c2f7c0e0ac2f8fe78844f8d26dfc112f73c3bc34ca475a56d7597440716ff89bab09fef6e020b9ec9c5a47285ba9964a01c016f1
SSDEEP

1536:TzgyM0ugfElMR+dn+5uiCM3rFSVnU9anonwAPU9/DFoHK:TzbvfElt+5uiCWFSVUgUwA89/5o

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b0d0641ebbc5d226f9ea9a0dbc39b7a_JaffaCakes118

Files

3b0d0641ebbc5d226f9ea9a0dbc39b7a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dd2a960e6e43fa1b85d6fcb7288f387c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindResourceA
GetComputerNameA
GetVolumeInformationA
GetDriveTypeA
LoadResource
GetProcAddress
LoadLibraryA
LCMapStringA
SetEndOfFile
LockResource
SizeofResource
FreeResource
GetModuleFileNameA
FreeLibrary
GetShortPathNameA
GetOEMCP
GetACP
GetCPInfo
CreateFileA
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
FlushFileBuffers
SetStdHandle
IsBadWritePtr
IsBadReadPtr
HeapValidate
ExitProcess
TerminateProcess
GetCurrentProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
GetLastError
CloseHandle
ReadFile
HeapAlloc
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetHandleCount
GetFileType
SetFilePointer
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
RtlUnwind
SetConsoleCtrlHandler
LCMapStringW

user32

FindWindowA

advapi32

RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetUserNameA

shell32

ShellExecuteA

wininet

FindCloseUrlCache
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
FindNextUrlCacheEntryA
FindFirstUrlCacheEntryA

Sections

.text
Size: 164KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 825B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dd2a960e6e43fa1b85d6fcb7288f387c

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

wininet

Sections

.text Size: 164KB - Virtual size: 161KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 8KB - Virtual size: 12KB

.idata Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 825B

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 164KB - Virtual size: 161KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 8KB - Virtual size: 12KB

.idata
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 825B

.reloc
Size: 8KB - Virtual size: 4KB