36fcb803139ee0ae9de2ee43045be976_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

36fcb803139ee0ae9de2ee43045be976_JaffaCakes118
Size

675KB
MD5

36fcb803139ee0ae9de2ee43045be976
SHA1

5d21ebc013f04c08c3500f57af48e85f21aa2f38
SHA256

3219dadc0731a218d1ec4323806aacb2ee7c1e8110573512603e91200a9cfcfe
SHA512

f7e18b6627a4144e51447a6af2efc79fabc62ebd9bb5b67e258173eee5063eb609fc3213486c558727e85a9a81a76eaac38723ce95f1323f9f367b81a310cd6b
SSDEEP

12288:1eOpZ3fM/MaBOZlEtYbVLqFjjSIZ7qnel4ohYqTJbnYq2Jx:1eOpZ3fMkaBOZlbVLqFiIdE44oyqlbnE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36fcb803139ee0ae9de2ee43045be976_JaffaCakes118

Files

36fcb803139ee0ae9de2ee43045be976_JaffaCakes118
.exe windows:1 windows x86 arch:x86

c75537bd885989fabe0dabca2599293e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
GetModuleFileNameA
WritePrivateProfileStringA
WriteFile
WaitForSingleObject
VirtualQuery
SuspendThread
Sleep
SizeofResource
SetFileTime
SetFilePointer
SetFileAttributesA
SetErrorMode
SetEndOfFile
SetCurrentDirectoryA
ResumeThread
RemoveDirectoryA
ReadFile
OpenMutexA
MultiByteToWideChar
MoveFileExA
MoveFileA
LockResource
LoadResource
LoadLibraryExA
LoadLibraryA
GetWindowsDirectoryA
GetVersionExA
GetTickCount
GetThreadLocale
GetTempPathA
GetTempFileNameA
GetSystemDirectoryA
GetShortPathNameA
GetProcAddress
GetPrivateProfileStringA
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoW
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileTime
GetFileSize
GetFileAttributesA
GetExitCodeThread
GetExitCodeProcess
GetEnvironmentVariableA
GetEnvironmentStringsA
GetDriveTypeA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentProcess
GetCurrentDirectoryA
GetCPInfo
FreeLibrary
FreeEnvironmentStringsA
FormatMessageA
FindResourceA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
ExpandEnvironmentStringsA
EnumSystemLocalesA
EnumCalendarInfoA
DeleteFileA
CreateThread
CreateProcessA
CreateMutexA
CreateFileA
CreateDirectoryA
CompareStringA
CloseHandle
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
VirtualQuery
WideCharToMultiByte
RemoveDirectoryA
MultiByteToWideChar
lstrlenA
lstrcpyA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetSystemTime
GetFileType
CreateFileA
CloseHandle

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

comctl32

InitCommonControls

gdi32

SelectObject
RemoveFontResourceA
GetObjectA
GetDeviceCaps
ExtCreateRegion
DeleteObject
DeleteDC
CreateCompatibleDC
BitBlt
AddFontResourceA
TranslateCharsetInfo

ole32

CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

GetErrorInfo
RegisterTypeLib
LoadTypeLib
SysFreeString
VariantChangeTypeEx
VariantCopyInd
VariantClear
SysStringLen
SysFreeString
SysReAllocStringLen
SysAllocStringLen

shell32

ShellExecuteExA
ShellExecuteA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHChangeNotify

user32

UnhookWindowsHookEx
TranslateMessage
SystemParametersInfoA
ShowWindow
SetWindowRgn
SetWindowsHookExA
SetWindowTextA
SetWindowPos
SetWindowLongA
SendMessageTimeoutA
SendMessageA
ReleaseDC
RegisterClassExA
RegisterClassA
RedrawWindow
PeekMessageA
OffsetRect
MoveWindow
MessageBoxA
LoadStringA
LoadImageA
LoadIconA
IsWindowVisible
GetWindowRect
GetSystemMetrics
GetParent
GetLastActivePopup
GetDlgItem
GetDC
ExitWindowsEx
EnumWindows
EndPaint
DispatchMessageA
DestroyWindow
DestroyIcon
DefWindowProcA
CreateWindowExA
CreateDialogParamA
CallNextHookEx
BeginPaint
CharUpperBuffA
CharToOemBuffA
GetKeyboardType
LoadStringA
MessageBoxA

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

Sections

CODE
Size: 232KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 429KB - Virtual size: 433KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c75537bd885989fabe0dabca2599293e

Headers

File Characteristics

Imports

kernel32

advapi32

comctl32

gdi32

ole32

oleaut32

shell32

user32

version

Sections

CODE Size: 232KB - Virtual size: 232KB

DATA Size: 7KB - Virtual size: 6KB

BSS Size: - Virtual size: 2KB

.idata Size: 5KB - Virtual size: 5KB

.tls Size: - Virtual size: 16B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: - Virtual size: 17KB

.rsrc Size: 429KB - Virtual size: 433KB

CODE
Size: 232KB - Virtual size: 232KB

DATA
Size: 7KB - Virtual size: 6KB

BSS
Size: - Virtual size: 2KB

.idata
Size: 5KB - Virtual size: 5KB

.tls
Size: - Virtual size: 16B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: - Virtual size: 17KB

.rsrc
Size: 429KB - Virtual size: 433KB