75d9e3650ddeea610d36dfea8835d311_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

75d9e3650ddeea610d36dfea8835d311_JaffaCakes118
Size

41KB
MD5

75d9e3650ddeea610d36dfea8835d311
SHA1

76b202b094e8d03f3f1a634a10b9ad61b285a9e9
SHA256

53f0f5234cb55119b720b6f2872f5d925bc7dc7e8bf0db15a09f15cb3b4f03e5
SHA512

e05e709debed1f9b9f481f117774dfcb717a868e38b9ea13845aa31921da234c59c37319a1c03371c25066242198e70aa60849ea444a29cff91f81339e821ab9
SSDEEP

768:aKzLDzz6vVqClb/e+7YliuyRcf7G0op0NqF5174CUweRY0BLGY7ZP:a+XhCFWvyRcf7pop0NCEC4Rv7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
75d9e3650ddeea610d36dfea8835d311_JaffaCakes118

Files

75d9e3650ddeea610d36dfea8835d311_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bc5fcd1df89986a202cdb4428c67c417

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrStrA
StrStrIA
StrChrA

kernel32

GetLastError
CreateMutexA
DeleteFileA
ReadFile
Sleep
WriteFile
CreateFileA
GetTickCount
GetVersionExA
ExitProcess
MoveFileA
TerminateProcess
OpenProcess
ExpandEnvironmentStringsA
lstrlenA
GetFileAttributesExA
SetFilePointer
GetModuleFileNameA
GetCurrentThread
OpenMutexA
lstrcpyA
MultiByteToWideChar
WideCharToMultiByte
GetTempPathA
CreateDirectoryA
GetEnvironmentVariableA
FindClose
FindNextFileA
FindFirstFileA
GetFileAttributesA
lstrcmpiA
CreateThread
LocalFree
GetComputerNameA
GetSystemInfo
GetVolumeInformationA
lstrcpynA
HeapFree
GetProcessHeap
HeapAlloc
WaitForSingleObject
ReleaseMutex
CreateProcessA
CreateToolhelp32Snapshot
CloseHandle
Process32First
Process32Next
GetStartupInfoA
lstrcatA
GetModuleHandleA

advapi32

LookupPrivilegeValueA
OpenThreadToken
AdjustTokenPrivileges
RegQueryValueExA
RegEnumValueA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ImpersonateSelf

shell32

ShellExecuteExA
ShellExecuteA

user32

GetCursorPos
wsprintfA
GetSystemMetrics

wininet

InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetGetConnectedState
FindFirstUrlCacheEntryA
DeleteUrlCacheEntry
FindCloseUrlCache
FindNextUrlCacheEntryA
InternetReadFile

netapi32

NetScheduleJobEnum
NetScheduleJobDel
NetApiBufferFree
NetScheduleJobAdd

msvcrt

_controlfp
__set_app_type
__p__fmode
_CxxThrowException
__dllonexit
__p__commode
_onexit
??1type_info@@UAE@XZ
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
strncpy
??3@YAXPAX@Z
??2@YAPAXI@Z
atoi
realloc
rand
strcmp
sprintf
free
strlen
getenv
malloc
_except_handler3
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
srand
wcslen
_snprintf
strcat
strcpy

ole32

CoCreateInstance
CoInitialize

oleaut32

SysAllocStringLen
VariantClear
VariantChangeType
SysAllocString
SysFreeString
SysStringLen

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bc5fcd1df89986a202cdb4428c67c417

Headers

File Characteristics

Imports

shlwapi

kernel32

advapi32

shell32

user32

wininet

netapi32

msvcrt

ole32

oleaut32

Sections

.text Size: 30KB - Virtual size: 29KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 3KB - Virtual size: 18KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 30KB - Virtual size: 29KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 3KB - Virtual size: 18KB

.reloc
Size: 3KB - Virtual size: 2KB