69636b42516de3e202ccb77e44544184_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

69636b42516de3e202ccb77e44544184_JaffaCakes118
Size

189KB
MD5

69636b42516de3e202ccb77e44544184
SHA1

9326a51dddabb16024c64692b41bf3560f60f3be
SHA256

0fae3f339197a1f7a96018d42050a48f742f6ac5984a5678142a7cc99f8a8a77
SHA512

b443c7ff6d6a169a3dbc455cccc68b154f49dc78562d0e2aac4a312874d99cc6f7e359246919bfa728137cecf403ab08cdc2641913b16111c62b0b5fbfc85e1a
SSDEEP

3072:s7bMYooa7f+VZJfC4Z53sZQRoASxpI63/fKXopZKb/1Qz5/td+20TJsq:0goa7f+VOssZtASxpI63UiKb/6ZNMJsq

Score

1^/10

Malware Config

Signatures

Files

69636b42516de3e202ccb77e44544184_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cc38eeecdd0eb0a11ca5d54370137111

Code Sign

82:d4:17:c9:4d:0d:7e:55:fd:ad:a5:c0:02:0d:de:91:bc:c1:98:dd
Signer

Actual PE Digest

82:d4:17:c9:4d:0d:7e:55:fd:ad:a5:c0:02:0d:de:91:bc:c1:98:dd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

sfc

SfcIsFileProtected

msvcrt

free
_strnicmp
_except_handler3
strcat
strncat
strchr
_itoa
_stricmp
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
tolower
toupper
malloc
strcpy
strncpy
_CxxThrowException
__CxxFrameHandler
strcmp
??3@YAXPAX@Z
memcpy
??2@YAPAXI@Z
_ftol
srand
rand
strstr
strlen
memset
_strlwr

user32

CharNextA
wsprintfA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA

shlwapi

SHDeleteKeyA

kernel32

lstrcatA
LoadLibraryA
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
GetStartupInfoA
VirtualProtect
CreateToolhelp32Snapshot
Process32First
GetCurrentProcessId
Process32Next
SetFileAttributesA
DeleteFileA
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineA
SetUnhandledExceptionFilter
OpenEventA
ExpandEnvironmentStringsA
GetShortPathNameA
GetFileAttributesA
CreateEventA
WaitForSingleObject
Sleep
GetModuleFileNameA
lstrcmpiA
GetSystemDirectoryA
GetTickCount
FindFirstFileA
FindNextFileA
CreateFileA
WriteFile
SetFilePointer
GetFileTime
SetFileTime
CloseHandle
MoveFileA
GetTempPathA
GetWindowsDirectoryA
lstrcpyA
SetEnvironmentVariableA
lstrlenA
CreateDirectoryA
ExitProcess
GetLastError
HeapFree
GetProcAddress
GetModuleHandleA
HeapAlloc
GetProcessHeap

netapi32

NetUserGetLocalGroups
NetApiBufferFree

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 160KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cc38eeecdd0eb0a11ca5d54370137111

Code Sign

82:d4:17:c9:4d:0d:7e:55:fd:ad:a5:c0:02:0d:de:91:bc:c1:98:ddSigner

Headers

File Characteristics

Imports

sfc

msvcrt

user32

version

shlwapi

kernel32

netapi32

Sections

.text Size: 16KB - Virtual size: 14KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 160KB - Virtual size: 162KB

.rsrc Size: 4KB - Virtual size: 3KB

82:d4:17:c9:4d:0d:7e:55:fd:ad:a5:c0:02:0d:de:91:bc:c1:98:dd
Signer

.text
Size: 16KB - Virtual size: 14KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 160KB - Virtual size: 162KB

.rsrc
Size: 4KB - Virtual size: 3KB