65dfddea0e2780e900b6fa31864bdb2a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

65dfddea0e2780e900b6fa31864bdb2a_JaffaCakes118
Size

546KB
MD5

65dfddea0e2780e900b6fa31864bdb2a
SHA1

d75254b856588960be0fe58776edc35494a89d26
SHA256

6093bab571e9c520542f61ee81e3d236f326ddbe05a29017bbd03a860fa42d28
SHA512

7e92845a5462f228d1d2626ec21ba5ab695325f464c90700a2c97bcbacfcceec407f20aa919c96a877e4a2e21924cd5abf73c2252a781af266feec5a783feae7
SSDEEP

12288:cZWhs5MdGV6wEpV8+9Nn+D/99Tu8MFAUvag16pQnndd:MOs5om+9N473GALgJd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
65dfddea0e2780e900b6fa31864bdb2a_JaffaCakes118

Files

65dfddea0e2780e900b6fa31864bdb2a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

47cbca3387eed59b12b4ca65e36bfac4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

h:\eaofwl\ete\tlrmopsrm\hoiwtoozka.pdb

Imports

shell32

CommandLineToArgvW
ShellExecuteEx

kernel32

GetEnvironmentStringsW
VirtualAlloc
LCMapStringA
GetCurrentProcess
CreateMutexA
InterlockedExchange
GetStringTypeW
GetCurrentProcessId
ReadFile
EnumSystemLocalesA
GetCurrentThreadId
FlushFileBuffers
HeapSize
GetTickCount
WideCharToMultiByte
HeapAlloc
CompareStringA
GetStartupInfoA
GetLocaleInfoW
HeapDestroy
TlsFree
CloseHandle
TerminateProcess
RemoveDirectoryW
LCMapStringW
DeleteCriticalSection
IsBadWritePtr
GetLocaleInfoA
VirtualQuery
HeapReAlloc
IsValidCodePage
MoveFileA
QueryPerformanceCounter
SetEndOfFile
GetProcAddress
UnlockFileEx
GetCommandLineA
CompareStringW
GetSystemDefaultLCID
GetUserDefaultLCID
TlsGetValue
GetCurrentThread
FreeEnvironmentStringsA
GetLastError
GetSystemTimeAsFileTime
MultiByteToWideChar
GetEnvironmentStrings
SetHandleCount
SetFilePointer
HeapFree
GetACP
IsValidLocale
ReadConsoleOutputA
LeaveCriticalSection
VirtualProtect
OpenMutexA
GetStringTypeA
GetTimeZoneInformation
GetSystemInfo
GetDateFormatA
GetFileType
WriteFile
GetVersionExA
GetOEMCP
EnterCriticalSection
GetModuleFileNameA
LoadModule
InitializeCriticalSection
SetLastError
FreeEnvironmentStringsW
GetModuleHandleA
GetTimeFormatA
TlsSetValue
UnhandledExceptionFilter
LoadLibraryA
VirtualFree
GetCPInfo
TlsAlloc
GetStdHandle
HeapCreate
ExitProcess
SetEnvironmentVariableA
SetStdHandle
RtlUnwind

comctl32

InitCommonControlsEx

user32

DdeQueryNextServer
TranslateAcceleratorA
EnumDesktopsW
SetWindowPlacement
ChangeDisplaySettingsExA
UnpackDDElParam
CharToOemA
AnyPopup
LookupIconIdFromDirectory
IsCharAlphaNumericA
GetDCEx
MonitorFromRect
GetUserObjectSecurity
ScreenToClient
GetTabbedTextExtentW
RegisterClassExA
RegisterClassA
IsIconic
ChangeMenuW
GetInputDesktop
WINNLSGetIMEHotkey

Sections

.text
Size: 358KB - Virtual size: 357KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 106KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

47cbca3387eed59b12b4ca65e36bfac4

Headers

File Characteristics

PDB Paths

Imports

shell32

kernel32

comctl32

user32

Sections

.text Size: 358KB - Virtual size: 357KB

.rdata Size: 58KB - Virtual size: 78KB

.data Size: 106KB - Virtual size: 105KB

.rsrc Size: 23KB - Virtual size: 22KB

.text
Size: 358KB - Virtual size: 357KB

.rdata
Size: 58KB - Virtual size: 78KB

.data
Size: 106KB - Virtual size: 105KB

.rsrc
Size: 23KB - Virtual size: 22KB