76792f73a0173a981db11bb3e8521bd6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

76792f73a0173a981db11bb3e8521bd6_JaffaCakes118
Size

258KB
MD5

76792f73a0173a981db11bb3e8521bd6
SHA1

b8b63e7df23edbdfe6bb91ebcde87288ddd5bd64
SHA256

f0f69a9c8e9138ab03f6516159baf8082f6d08bd43a0cf6c0f237c5638d624ff
SHA512

ca46b6e412ae63eaf117363fc3b9c6a9d7daa1198ce8b8408117b4b929d481dc0ecd6e22bb4262157da28e70bdeb744769b49afd6f40077f5d34af8aa800a91b
SSDEEP

6144:vrwuWYTJFADyfeZDI5tkFR/3gXqDwTIDEuvKk4fgs+TaVsTXP6t:vrV9MI5tgR/ZwTFbG1aVsLw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
76792f73a0173a981db11bb3e8521bd6_JaffaCakes118

Files

76792f73a0173a981db11bb3e8521bd6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

54a6f55c402a9b841db22809beaee731

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\egtietr\tur\rbtojvgs\qny\heoec.pdb

Imports

comctl32

InitCommonControlsEx

shell32

SHFileOperationW
SHEmptyRecycleBinW
ExtractAssociatedIconA
DoEnvironmentSubstA

kernel32

GetStdHandle
GetStartupInfoA
HeapFree
IsBadWritePtr
HeapAlloc
GetCurrentProcess
GetEnvironmentStringsW
VirtualAlloc
CreateMutexA
HeapDestroy
lstrlenW
GetLastError
VirtualQuery
GetStringTypeExA
GetConsoleMode
InterlockedExchange
GetLocalTime
OpenMutexA
TlsAlloc
GetModuleFileNameA
LCMapStringW
ReadFile
GetStartupInfoW
GetVersion
WideCharToMultiByte
GetTimeZoneInformation
SetConsoleScreenBufferSize
InterlockedDecrement
SetFilePointer
GetCPInfo
HeapCreate
VirtualFree
GetFileType
EnumTimeFormatsW
GetCurrentThread
EnumSystemCodePagesW
SetHandleCount
SetEnvironmentVariableA
WriteFile
GetCurrentProcessId
ExitProcess
TlsFree
GetEnvironmentStrings
RtlUnwind
GetVersionExW
GetWindowsDirectoryW
LCMapStringA
HeapReAlloc
GetTickCount
LoadLibraryA
GetCurrentThreadId
InterlockedIncrement
GetCommandLineA
FreeEnvironmentStringsW
FlushFileBuffers
TerminateProcess
TlsGetValue
SetLastError
InitializeCriticalSection
GetStringTypeA
TlsSetValue
LocalFree
QueryPerformanceCounter
CloseHandle
WriteConsoleA
ReadConsoleOutputCharacterW
GetProcAddress
LeaveCriticalSection
CreateFileA
GetSystemTimeAsFileTime
WriteConsoleOutputA
GetSystemTime
UnhandledExceptionFilter
CompareStringW
FreeEnvironmentStringsA
GetModuleFileNameW
EnterCriticalSection
SetStdHandle
CompareStringA
MultiByteToWideChar
DeleteCriticalSection
GetModuleHandleA
GetStringTypeW
GetCommandLineW

wininet

FtpFindFirstFileW
InternetWriteFile

comdlg32

GetSaveFileNameW
ChooseFontA
GetOpenFileNameW
GetOpenFileNameA

user32

DdeClientTransaction
PostMessageW
MessageBoxW
IsCharUpperA
SetCursor
DlgDirListW
GetClipboardData
CharToOemW
UnpackDDElParam
ScrollDC
GetClipboardOwner
DrawEdge
DialogBoxParamA
RegisterClassA
CopyAcceleratorTableA
EnumClipboardFormats
FreeDDElParam
ShowWindow
SetWindowsHookExW
CreateDialogParamW
ArrangeIconicWindows
GetWindowModuleFileNameW
DefMDIChildProcW
RegisterClassExA
TrackMouseEvent
CreateWindowExW
EnumChildWindows
GetDoubleClickTime

Sections

.text
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

54a6f55c402a9b841db22809beaee731

Headers

File Characteristics

PDB Paths

Imports

comctl32

shell32

kernel32

wininet

comdlg32

user32

Sections

.text Size: 135KB - Virtual size: 135KB

.rdata Size: 23KB - Virtual size: 49KB

.data Size: 85KB - Virtual size: 84KB

.rsrc Size: 13KB - Virtual size: 12KB

.text
Size: 135KB - Virtual size: 135KB

.rdata
Size: 23KB - Virtual size: 49KB

.data
Size: 85KB - Virtual size: 84KB

.rsrc
Size: 13KB - Virtual size: 12KB