759566705625e17443c2a5a138463f54_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

759566705625e17443c2a5a138463f54_JaffaCakes118
Size

284KB
MD5

759566705625e17443c2a5a138463f54
SHA1

d014f030182c58cbe3c583f825afdd405abf9268
SHA256

0bd08d0355138bdd630b69bede9468c51dfc1241de19ea5c4beeac21140a538c
SHA512

cc6afb1ffea16f46d94ec39ca43d81417ed27888ed7ffb7e2eb2466ca4096a2411b1a4b44e7cf48793499a6ee238d4ce6fdc8040adbf12eb8fd41fb4357f05c3
SSDEEP

6144:TFOgO7KqQPMe6i3odghFz88ClKs1vfY6sH:UDKbks3oCh28Olg6Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
759566705625e17443c2a5a138463f54_JaffaCakes118

Files

759566705625e17443c2a5a138463f54_JaffaCakes118
.exe windows:4 windows x86 arch:x86

532ded5f47a51140f595a9fd20180a30

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindResourceA
GetLastError
SizeofResource
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
SetEvent
LoadResource
LoadLibraryExA
InterlockedDecrement
WaitForSingleObject
CreateThread
CreateEventA
InterlockedIncrement
Sleep
GetCurrentThreadId
GetCommandLineA
HeapDestroy
GetProcAddress
CloseHandle
DeleteCriticalSection
lstrcatA
GetSystemDefaultLCID
LocalFree
FormatMessageA
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
GetLocalTime
GetCurrentProcessId
FreeResource
LockResource
GetACP
GetLocaleInfoA
GlobalDeleteAtom
GlobalAddAtomA
SetLastError
GetComputerNameA
GetCurrentThread
FreeLibrary
WideCharToMultiByte
GetModuleHandleA
InitializeCriticalSection
GetModuleFileNameA
MultiByteToWideChar
GetShortPathNameA
lstrlenA
LoadLibraryA
lstrcpyA
EnterCriticalSection
HeapCreate
SetEnvironmentVariableA
CompareStringW
CompareStringA
ReadFile
SetEndOfFile
CreateFileA
GetStringTypeW
GetStringTypeA
SetFilePointer
SetStdHandle
IsBadCodePtr
IsBadReadPtr
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
LeaveCriticalSection
lstrlenW
WriteFile
FlushFileBuffers
GetOEMCP
GetCPInfo
SetUnhandledExceptionFilter
HeapSize
IsBadWritePtr
VirtualAlloc
VirtualFree
GetVersionExA
GetEnvironmentVariableA
GetVersion
GetStartupInfoA
GetCurrentProcess
TerminateProcess
ExitProcess
GetSystemTime
GetTimeZoneInformation
RtlUnwind
RaiseException

user32

TranslateMessage
GetMessageA
LoadStringA
RegisterWindowMessageA
OpenDesktopA
SetProcessWindowStation
SetThreadDesktop
GetThreadDesktop
GetProcessWindowStation
OpenWindowStationA
DefWindowProcA
GetWindowLongA
RegisterClassExA
CreateWindowExA
GetDesktopWindow
SetWindowLongA
CharNextA
PostThreadMessageA
DispatchMessageA
IsWindow
wsprintfA
SendMessageA
CloseWindowStation
CloseDesktop
CharUpperA

advapi32

RegQueryValueExA
GetTokenInformation
RegCreateKeyExA
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
RegQueryInfoKeyA
RegEnumValueA
RegSetValueExA
OpenThreadToken

ole32

CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoTaskMemRealloc
CoSuspendClassObjects
CoInitializeSecurity
CoUninitialize
CoResumeClassObjects
CoRevokeClassObject
CoInitializeEx
CoRegisterClassObject
CoSetProxyBlanket
CoImpersonateClient
CoRevertToSelf

oleaut32

SafeArrayGetUBound
SafeArrayGetLBound
LoadTypeLi
SafeArrayGetElement
SysStringLen
SafeArrayCreate
SafeArrayDestroy
RegisterTypeLi
VarUI4FromStr
SysAllocStringLen
SysAllocString
VariantClear
SysFreeString
VariantInit
SafeArrayPutElement

secur32

GetUserNameExA

Sections

.text
Size: 140KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.cjtn
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ordata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

532ded5f47a51140f595a9fd20180a30

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

secur32

Sections

.text Size: 140KB - Virtual size: 136KB

.rdata Size: 24KB - Virtual size: 21KB

.data Size: 28KB - Virtual size: 34KB

.tls Size: 4KB - Virtual size: 12B

.rsrc Size: 16KB - Virtual size: 14KB

.cjtn Size: 40KB - Virtual size: 37KB

.ordata Size: 28KB - Virtual size: 28KB

.text
Size: 140KB - Virtual size: 136KB

.rdata
Size: 24KB - Virtual size: 21KB

.data
Size: 28KB - Virtual size: 34KB

.tls
Size: 4KB - Virtual size: 12B

.rsrc
Size: 16KB - Virtual size: 14KB

.cjtn
Size: 40KB - Virtual size: 37KB

.ordata
Size: 28KB - Virtual size: 28KB