75ccaa0b2062bce6205f5eac50b2a0c7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

75ccaa0b2062bce6205f5eac50b2a0c7_JaffaCakes118
Size

671KB
MD5

75ccaa0b2062bce6205f5eac50b2a0c7
SHA1

683b1d99a87c850dbec9dc552d0daa8a414b9947
SHA256

7c5ad57379e286841289b1c736f9db549b95e0564c2bcad348c4e2f851dba856
SHA512

34d728ef8a96766574ee1b4047722c5d1b4478222ac1b589246c57a71ee0dd6fec86ef4497ded8a8f0972a1eb9e16e5e8de0c986501b5b47c2d8bf8420a5d0eb
SSDEEP

12288:rhwiNEIoJdGp6B/QoJq1xfZnz2qB8sNeRko2t+:rhw8EIu0pA1q1xflvkRGM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
75ccaa0b2062bce6205f5eac50b2a0c7_JaffaCakes118

Files

75ccaa0b2062bce6205f5eac50b2a0c7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4dc65495c4fc62bc2e4a52043c2295ce

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\gfwkmse\njiobos.pdb

Imports

user32

RegisterClassExA
RegisterClassA
LookupIconIdFromDirectory

comctl32

InitCommonControlsEx

kernel32

WaitForDebugEvent
DeleteCriticalSection
TlsFree
RtlMoveMemory
GetLocaleInfoW
GetCurrentProcess
GetDateFormatA
GetCPInfo
GetLogicalDriveStringsW
GetStringTypeW
GetCurrentProcessId
GetProfileSectionW
TlsSetValue
GlobalFlags
GetEnvironmentStringsW
OpenWaitableTimerA
InterlockedDecrement
UnhandledExceptionFilter
GetModuleHandleW
HeapCreate
EnterCriticalSection
LoadLibraryA
ExitProcess
GetConsoleMode
SetLastError
CreateFileA
VirtualAlloc
HeapSize
SetConsoleCtrlHandler
GetSystemDirectoryW
GetConsoleTitleW
WriteFile
GetCurrentThread
GetLastError
FreeLibrary
TerminateProcess
LoadResource
GetConsoleOutputCP
EnumTimeFormatsW
GetThreadTimes
HeapFree
WriteConsoleW
ReadFile
CompareStringW
HeapAlloc
QueryPerformanceCounter
GetModuleHandleA
FlushFileBuffers
GetEnvironmentStrings
VirtualFreeEx
RemoveDirectoryA
SetEnvironmentVariableA
InterlockedIncrement
GetTimeZoneInformation
GetStdHandle
WideCharToMultiByte
GetNamedPipeHandleStateA
IsValidCodePage
GetFileAttributesExW
WriteConsoleA
InterlockedExchange
HeapReAlloc
GetPrivateProfileStructW
RtlUnwind
GetConsoleCP
GetOEMCP
TlsAlloc
CloseHandle
GetStartupInfoA
GetTickCount
GetTimeFormatA
Sleep
LCMapStringA
FreeEnvironmentStringsW
GetACP
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
GetSystemTimeAsFileTime
FreeEnvironmentStringsA
SetFilePointer
LCMapStringW
GetUserDefaultLCID
VirtualFree
CompareStringA
GetCommandLineA
GetStringTypeA
VirtualQuery
EnumSystemLocalesA
DeleteFileW
HeapDestroy
GetProcAddress
MultiByteToWideChar
SetUnhandledExceptionFilter
SetHandleCount
IsDebuggerPresent
TlsGetValue
SetStdHandle
GetLocaleInfoA
OpenMutexA
CreateMutexA
IsValidLocale
GetCurrentThreadId
GetFileType
LeaveCriticalSection

Sections

.text
Size: 498KB - Virtual size: 497KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4dc65495c4fc62bc2e4a52043c2295ce

Headers

File Characteristics

PDB Paths

Imports

user32

comctl32

kernel32

Sections

.text Size: 498KB - Virtual size: 497KB

.rdata Size: 48KB - Virtual size: 72KB

.data Size: 111KB - Virtual size: 110KB

.rsrc Size: 13KB - Virtual size: 12KB

.text
Size: 498KB - Virtual size: 497KB

.rdata
Size: 48KB - Virtual size: 72KB

.data
Size: 111KB - Virtual size: 110KB

.rsrc
Size: 13KB - Virtual size: 12KB