783d318de415e48c22b40683930de33d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

783d318de415e48c22b40683930de33d_JaffaCakes118
Size

424KB
MD5

783d318de415e48c22b40683930de33d
SHA1

84a6de0e931a11b32c076a7b5c7f9e51d4aac9e3
SHA256

60d415df4db9b07aad6b01e507c7446ac50a211da7786ffd5c341640e3839cad
SHA512

79fddfc39522d2a63c6cd7099d243adcd44a84f06bc3f0bfa1d398995881b1a2c93f4c5fce056d518feb735dc1c6dcd7b379572c25e85cb431149c3284219c15
SSDEEP

12288:okdGr8Vezlmi3lHbI2MBTad+sp/lK9wb+Ha:hdGr8qlmi9bI2Ldrp9o6O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
783d318de415e48c22b40683930de33d_JaffaCakes118

Files

783d318de415e48c22b40683930de33d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

aa0ce1405bb179d09677083305f64dce

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
WriteFile
SetEvent
GetTickCount
GetProcAddress
GetLastError
GetModuleHandleA
LoadLibraryA
InterlockedExchange
Sleep
lstrcatA
ResetEvent
CloseHandle
FlushFileBuffers
SetStdHandle
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
DebugBreak
GetStdHandle
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
GetModuleFileNameA
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
VirtualFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
RtlUnwind
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
SetFilePointer
LCMapStringA
LCMapStringW

user32

LoadBitmapA
GetClientRect
PostMessageA
GetActiveWindow
GetFocus
ShowWindow

msvfw32

ICClose

winmm

joyGetPosEx
joyGetDevCapsA
joySetThreshold

Exports

Exports

?Loader@@YAKKK@Z

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 156KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 204KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 8KB - Virtual size: 389KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aa0ce1405bb179d09677083305f64dce

Headers

File Characteristics

Imports

kernel32

user32

msvfw32

winmm

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 38KB

.rdata Size: 156KB - Virtual size: 152KB

.data Size: 204KB - Virtual size: 209KB

.tls Size: 8KB - Virtual size: 389KB

.rsrc Size: 12KB - Virtual size: 9KB

.text
Size: 40KB - Virtual size: 38KB

.rdata
Size: 156KB - Virtual size: 152KB

.data
Size: 204KB - Virtual size: 209KB

.tls
Size: 8KB - Virtual size: 389KB

.rsrc
Size: 12KB - Virtual size: 9KB