6565b1b6365dfd526012a8e41a0709d3_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

6565b1b6365dfd526012a8e41a0709d3_JaffaCakes118
Size

536KB
MD5

6565b1b6365dfd526012a8e41a0709d3
SHA1

3773da4600275b0b85cbf742d838c21f8e3ccda2
SHA256

da86b90f00ce570c4f48ec37e37d26ddf5310408d59fd65030f3f4bc5487eba8
SHA512

6230ba53fb2ec6144a8d93da1d151a8c6b6683c3f95b3d89dd55b04db4d08fa318d97b7a10a8a4122f61605bcd1f2e9cc85176a5dcdad1b5742e5bbb2bbc798c
SSDEEP

6144:9PYXgBqXsp57hbP7QHHMZmJ9ZspV7ZHygE50rgtnxPBs+jIbFqEY4PcMlFuTRFf/:9Vf57EHMZmJH8V9HngtxWBqcUMlyL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6565b1b6365dfd526012a8e41a0709d3_JaffaCakes118

Files

6565b1b6365dfd526012a8e41a0709d3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

75005cd6a0c9ed12aeff45ddae6a2465

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\programming\work\arhexe_error\Release\mp3extractor.pdb

Imports

kernel32

GetCurrentProcess
GetModuleHandleW
WriteFile
GetSystemDirectoryW
SizeofResource
CreateFileW
GetCurrentDirectoryW
LockResource
CloseHandle
CreateProcessW
FlushFileBuffers
CreateFileA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LoadResource
FindResourceW
GetLocaleInfoA
GetLastError
HeapFree
HeapAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCommandLineA
GetVersionExA
GetProcessHeap
GetStartupInfoA
RaiseException
RtlUnwind
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetProcAddress
GetModuleHandleA
ExitProcess
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
Sleep
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
InitializeCriticalSection
LoadLibraryA
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar

user32

DispatchMessageW
GetMessageW
PostQuitMessage
LoadCursorW
TranslateMessage
RegisterClassExW
LoadIconW
GetWindowTextW
SetClassLongW
ShowWindow
GetSysColorBrush
CreateWindowExW
MessageBoxW
SendMessageW
UpdateWindow
SetWindowTextW
DefWindowProcW

gdi32

CreateFontW
SetBkColor

comdlg32

GetSaveFileNameW

Sections

.text
Size: 80KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 428KB - Virtual size: 427KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

75005cd6a0c9ed12aeff45ddae6a2465

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

Sections

.text Size: 80KB - Virtual size: 76KB

.rdata Size: 20KB - Virtual size: 16KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 428KB - Virtual size: 427KB

.text
Size: 80KB - Virtual size: 76KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 428KB - Virtual size: 427KB