4d44f0ce266e60f9b169b902991827aa_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4d44f0ce266e60f9b169b902991827aa_JaffaCakes118
Size

179KB
MD5

4d44f0ce266e60f9b169b902991827aa
SHA1

64a8ecf610097498ec76ab478e554c7edb8b553b
SHA256

67baa4846d200760b0a21837b9eccfe4ea676e37989b1a9bdce1220f15fb41da
SHA512

41063b3b33a0a03ffc266a03b6d17a253cff5f3f6dc398843d706626cd581c6cba1624a5282b410a04e732e4eedd0df6d2eb7ff3be8444c4a748406db235d689
SSDEEP

3072:UQa6HElmCLBefEIjl6Qr8WJgXR7d3s9vl5uEHuJ5VfWL:UCklDLBAwE8oIR7+n5fOlfi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d44f0ce266e60f9b169b902991827aa_JaffaCakes118

Files

4d44f0ce266e60f9b169b902991827aa_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a4a5223a399bf4457edb30be6ad8a9af

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\work\foxglina\installer\Release\installer.pdb

Imports

userenv

GetProfilesDirectoryW

shlwapi

StrNCatW
StrCpyNW
StrRChrW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

IsBadWritePtr
VirtualAlloc
VirtualFree
lstrcpyA
lstrlenA
GetLastError
ReadFile
CreateFileW
WriteFile
CloseHandle
GetFileSize
SetFileAttributesW
DeleteFileW
SetFilePointer
FindNextFileW
FindFirstFileW
GetModuleHandleW
lstrcmpW
Sleep
lstrlenW
IsBadReadPtr
GetModuleFileNameW
GetCurrentProcess
GetProcAddress
lstrcpyW
WinExec
lstrcpynW
GetComputerNameW
GetLocalTime
WideCharToMultiByte
MultiByteToWideChar
GetTempPathW
GetVersionExW
ExitProcess
LCMapStringW
HeapCreate
HeapDestroy
GetFileType
SetHandleCount
IsBadCodePtr
LoadLibraryA
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
GetCPInfo
SetStdHandle
FlushFileBuffers
GetLocaleInfoA
VirtualProtect
GetSystemInfo
LCMapStringA
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlUnwind
RaiseException
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
HeapAlloc
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
HeapReAlloc
TerminateProcess
HeapSize
SetUnhandledExceptionFilter
InterlockedExchange
VirtualQuery
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings

user32

wsprintfW
IsCharAlphaW

advapi32

GetUserNameW
RegDeleteValueW
RegCloseKey
RegQueryValueExW
RegCreateKeyExW

shell32

SHGetFolderPathW

Sections

.text
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a4a5223a399bf4457edb30be6ad8a9af

Headers

File Characteristics

PDB Paths

Imports

userenv

shlwapi

version

kernel32

user32

advapi32

shell32

Sections

.text Size: 59KB - Virtual size: 58KB

.rdata Size: 26KB - Virtual size: 26KB

.data Size: 68KB - Virtual size: 73KB

.rsrc Size: 25KB - Virtual size: 24KB

.text
Size: 59KB - Virtual size: 58KB

.rdata
Size: 26KB - Virtual size: 26KB

.data
Size: 68KB - Virtual size: 73KB

.rsrc
Size: 25KB - Virtual size: 24KB