638c73bd9ef57fff59f2ecc9ed9b3100_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

638c73bd9ef57fff59f2ecc9ed9b3100_JaffaCakes118
Size

2.7MB
MD5

638c73bd9ef57fff59f2ecc9ed9b3100
SHA1

f763efe428393c77f12a31b56934ad38f1edbef0
SHA256

45803ce3b9bcb4d63079f4d351b781d3492a9294bcf6c36779b534fd612ff461
SHA512

dc56579bab032222e3a1241134e229c458e6c71d996c5dd0f49631e7996e91acd83020e3f5b776077a85be5a311b10632179faf0feea3e4316375059299e1186
SSDEEP

49152:veFJETM1xZQCQaalwUbpEhuFArsyvSvJLwqSlFK9/AWnzVGnEjcs8rV:2j95Op1AgUSvJLwdlu/rnhGc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
638c73bd9ef57fff59f2ecc9ed9b3100_JaffaCakes118

Files

638c73bd9ef57fff59f2ecc9ed9b3100_JaffaCakes118
.exe windows:5 windows x86 arch:x86

639172c969cf2816579eeec6096bb435

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

CreateThread
GlobalUnlock
GlobalLock
GlobalAlloc
GetTickCount
WideCharToMultiByte
IsBadReadPtr
GlobalAddAtomA
GlobalAddAtomW
GetModuleHandleA
GlobalFree
GlobalGetAtomNameA
GlobalDeleteAtom
GlobalGetAtomNameW
FreeConsole
GetEnvironmentVariableA
VirtualProtect
VirtualAlloc
GetProcAddress
GetLastError
LoadLibraryA
SetLastError
SetThreadPriority
GetCurrentThread
SetEnvironmentVariableA
ReleaseMutex
WaitForSingleObject
CreateMutexA
OpenMutexA
SetErrorMode
GetCurrentThreadId
FindClose
FindFirstFileW
VirtualQueryEx
GetExitCodeProcess
ReadProcessMemory
VirtualProtectEx
ContinueDebugEvent
ResumeThread
OutputDebugStringA
OutputDebugStringW
SetThreadContext
GetThreadContext
WaitForDebugEvent
WriteProcessMemory
UnmapViewOfFile
SuspendThread
DebugActiveProcess
MapViewOfFile
DuplicateHandle
GetCurrentProcess
CreateFileMappingA
SetEvent
CreateEventA
MultiByteToWideChar
CloseHandle
CreateProcessA
GetStartupInfoA
GetCommandLineA
GetSystemTimeAsFileTime
ExitProcess
LocalFree
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FormatMessageA
GetConsoleMode
GetConsoleCP
SetFilePointer
GetLocaleInfoW
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
Sleep
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
InitializeCriticalSection
GetCurrentProcessId
GetModuleFileNameW
GetShortPathNameW
GetModuleFileNameA
CreateFileA
GetShortPathNameA
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
DeleteCriticalSection
RtlUnwind
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
GetProcessHeap
GetCPInfo
LCMapStringA
LCMapStringW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
WriteFile
GetStdHandle
HeapSize
GetACP
GetOEMCP
IsValidCodePage
HeapDestroy
HeapCreate
VirtualFree
HeapReAlloc

user32

LoadStringW
IsWindow
PostMessageA
GetDesktopWindow
MoveWindow
SetPropA
EnumThreadWindows
GetPropA
GetMessageA
BeginPaint
KillTimer
GetAsyncKeyState
GetSystemMetrics
SetTimer
SetWindowTextA
GetDlgItem
CreateDialogIndirectParamA
ShowWindow
UpdateWindow
LoadStringA
EndPaint
FindWindowA
WaitForInputIdle
DestroyWindow
MessageBoxA
InSendMessage
UnpackDDElParam
FreeDDElParam
DefWindowProcW
DefWindowProcA
LoadCursorA
RegisterClassW
CreateWindowExW
RegisterClassA
CreateWindowExA
GetWindowThreadProcessId
SendMessageW
SendMessageA
PeekMessageA
TranslateMessage
DispatchMessageA
EnumWindows
IsWindowUnicode
PackDDElParam
PostMessageW

gdi32

SelectObject
BitBlt
DeleteObject
CreatePalette
CreateDCA
SelectPalette
RealizePalette
CreateDIBitmap
DeleteDC
CreateCompatibleDC

Sections

.owsu
Size: - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ivzph
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.mzxyb
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 22KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rspnha
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.nyrvj
Size: - Virtual size: 934B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 72B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wchmxz
Size: 4KB - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.cbpy
Size: - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.qfml
Size: 392KB - Virtual size: 448KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ofaztg
Size: 52KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xzcd
Size: 84KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.kyzo
Size: 36KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.urwecv
Size: 2.1MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.lucrdo
Size: 16KB - Virtual size: 852KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

639172c969cf2816579eeec6096bb435

Headers

File Characteristics

Imports

kernel32

user32

gdi32

Sections

.owsu Size: - Virtual size: 3.1MB

.ivzph Size: - Virtual size: 9KB

.mzxyb Size: - Virtual size: 32KB

.bss Size: - Virtual size: 22KB

.rspnha Size: - Virtual size: 18KB

.nyrvj Size: - Virtual size: 934B

.tls Size: - Virtual size: 72B

.wchmxz Size: 4KB - Virtual size: 24B

.cbpy Size: - Virtual size: 225KB

.qfml Size: 392KB - Virtual size: 448KB

.ofaztg Size: 52KB - Virtual size: 64KB

.xzcd Size: 84KB - Virtual size: 128KB

.kyzo Size: 36KB - Virtual size: 64KB

.urwecv Size: 2.1MB - Virtual size: 2.2MB

.lucrdo Size: 16KB - Virtual size: 852KB

.owsu
Size: - Virtual size: 3.1MB

.ivzph
Size: - Virtual size: 9KB

.mzxyb
Size: - Virtual size: 32KB

.bss
Size: - Virtual size: 22KB

.rspnha
Size: - Virtual size: 18KB

.nyrvj
Size: - Virtual size: 934B

.tls
Size: - Virtual size: 72B

.wchmxz
Size: 4KB - Virtual size: 24B

.cbpy
Size: - Virtual size: 225KB

.qfml
Size: 392KB - Virtual size: 448KB

.ofaztg
Size: 52KB - Virtual size: 64KB

.xzcd
Size: 84KB - Virtual size: 128KB

.kyzo
Size: 36KB - Virtual size: 64KB

.urwecv
Size: 2.1MB - Virtual size: 2.2MB

.lucrdo
Size: 16KB - Virtual size: 852KB