3e8be3619157f9f5516422617282cab3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3e8be3619157f9f5516422617282cab3_JaffaCakes118
Size

188KB
MD5

3e8be3619157f9f5516422617282cab3
SHA1

2dd7960a939e344bac3e7be7d58303a39c593505
SHA256

19aa49ae3bb96f50a5cde5cee21cd86e2969a46722ff95c8a52aa3469dd48c09
SHA512

237d595818acda816f4f398f880bbcb118750f7d56753ee784c0d69edc145a53c0fdcd55ee4aa0b9a8dde43252a7a54e9d31d13c6ba34e2f04735284e11e0de8
SSDEEP

3072:Vhjf8BYJw9ZB8nSZgkZ6kZc9aMHK/cGC5A7D1zRtVoKiG62LGDMv:jf1w6nSZgkFkGbf1lzbLW6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e8be3619157f9f5516422617282cab3_JaffaCakes118

Files

3e8be3619157f9f5516422617282cab3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

22374bf829a51b7649c78ba4b0ab63f7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueA
RegOpenKeyExA
RegEnumKeyExA

kernel32

GetTapeParameters
IsBadReadPtr
InterlockedDecrement
GetProcAddress
WaitForMultipleObjects
CreateSemaphoreA
LeaveCriticalSection
CreateThread
CloseHandle
GetCurrentProcessId
HeapFree
ReleaseSemaphore
ClearCommError
ResetEvent
ReleaseMutex
EnterCriticalSection
LoadLibraryW
WideCharToMultiByte
GetACP
GlobalAlloc
GetCurrentThread
MultiByteToWideChar
CreateFileW
CreateMutexA
SetThreadPriority
ResumeThread
FreeLibrary
lstrlenA
EnumResourceNamesA
QueryPerformanceCounter
CreateEventA
SetEvent
LocalFree
GetVersionExA
IsBadWritePtr
FindResourceA
GetSystemTimeAsFileTime
GetSystemInfo
GetCurrentThreadId
LoadLibraryA
GetLastError
GetProcessHeap
InitializeCriticalSection
FatalExit
VirtualAlloc
GetModuleFileNameW
VirtualFree
GetModuleFileNameA
GetTickCount
LockResource
TerminateThread
LoadResource
GetExitCodeThread
DisableThreadLibraryCalls
GetThreadPriority
GetSystemTime
DeleteCriticalSection
Sleep
InterlockedIncrement
WaitForSingleObject
ExitProcess

user32

GetQueueStatus
CreateWindowExA
MsgWaitForMultipleObjects
LoadStringA
wsprintfA
GetMessageA
CopyRect
PostThreadMessageA
MonitorFromWindow
PeekMessageA
DispatchMessageA
wvsprintfA
RegisterWindowMessageA
RegisterClassA
DestroyWindow

shell32

SHGetSpecialFolderPathA

ole32

CoInitialize
CoInitializeEx
CoTaskMemFree
CreateItemMoniker
CreateStreamOnHGlobal
StringFromCLSID
CoCreateInstance
CoRevokeClassObject
CoUninitialize
CLSIDFromString
StringFromGUID2
GetRunningObjectTable
CoFreeUnusedLibraries
CoRegisterClassObject
CoTaskMemAlloc

winmm

timeGetDevCaps
timeBeginPeriod
timeGetTime
timeEndPeriod

oleacc

LresultFromObject
CreateStdAccessibleObject

Sections

.text
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.lib
Size: 512B - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

22374bf829a51b7649c78ba4b0ab63f7

Headers

File Characteristics

Imports

advapi32

kernel32

user32

shell32

ole32

winmm

oleacc

Sections

.text Size: 123KB - Virtual size: 122KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 60KB - Virtual size: 59KB

.lib Size: 512B - Virtual size: 120KB

.text
Size: 123KB - Virtual size: 122KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 60KB - Virtual size: 59KB

.lib
Size: 512B - Virtual size: 120KB