81db79ef0ce667866d095a54cbabe0e0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

81db79ef0ce667866d095a54cbabe0e0_JaffaCakes118
Size

41KB
MD5

81db79ef0ce667866d095a54cbabe0e0
SHA1

1c3b75b84a7d6381347017c5ea9591f1fb13805c
SHA256

9596448521dbb1130d7d92d39fb8257d041dd30059db603a97baeca0edb1e212
SHA512

bb0f700b3fa4b91d7b338d835470878e900cd0ebc38dbfafab699a75fbdaf72a6bb41dbb2993e80964fc2ccbc7fb2e1472bdf56928ed0930feb55a564dbbe2c9
SSDEEP

768:EHaqu/RZjNqbf7kTlz08WhTdpVHqyxDzn3WG3MJEYoPhJv3:BZobITl48SgaDzn313MJEDJv3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
81db79ef0ce667866d095a54cbabe0e0_JaffaCakes118

Files

81db79ef0ce667866d095a54cbabe0e0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d9b63ea2511e343cf7b6aa363615dec7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\01.Project\02.ocs\04.OCS_2.0_New\02.Updater\OCSUpdate\OCSUpdate\Release\OCS.pdb

Imports

netapi32

Netbios

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

mfc71

ord2410
ord2394
ord2400
ord2398
ord2396
ord2413
ord2408
ord2392
ord2415
ord2403
ord2385
ord2387
ord2405
ord2178
ord2172
ord1522
ord6279
ord3802
ord6277
ord3345
ord4967
ord1362
ord1964
ord1656
ord1655
ord1599
ord5200
ord2537
ord2731
ord2835
ord4307
ord2714
ord2862
ord2540
ord2646
ord2533
ord3718
ord3719
ord3709
ord2644
ord3949
ord4486
ord4265
ord635
ord562
ord395
ord751
ord4299
ord5165
ord762
ord4469
ord4467
ord3683
ord4038
ord4014
ord6278
ord3801
ord6276
ord4326
ord2063
ord2018
ord5583
ord3806
ord1010
ord5102
ord6219
ord5382
ord3832
ord1920
ord2931
ord5224
ord5226
ord2248
ord3948
ord4568
ord5230
ord5213
ord5566
ord2838
ord4481
ord4261
ord3333
ord757
ord566
ord1247
ord1248
ord1091
ord2430
ord593
ord5225
ord334
ord959
ord547
ord4031
ord5975
ord1054
ord3830
ord5007
ord4477
ord3645
ord3450
ord4566
ord2614
ord2621
ord6238
ord2016
ord2051
ord5156
ord5592
ord1379
ord5412
ord2742
ord5495
ord4257
ord4852
ord4739
ord1922
ord4222
ord3040
ord2768
ord5934
ord6043
ord4482
ord4264
ord2390
ord616
ord4705
ord3647
ord3465
ord732
ord3740
ord4444
ord4443
ord4790
ord4204
ord4781
ord4388
ord4980
ord4171
ord4178
ord4776
ord4386
ord4401
ord4399
ord4381
ord4384
ord4379
ord4863
ord4860
ord3974
ord5914
ord3946
ord5151
ord5204
ord4282
ord3344
ord1360
ord1556
ord1084
ord715
ord5174
ord6067
ord2657
ord5522
ord3085
ord4587
ord2419
ord2420
ord2421
ord2418
ord2417
ord1643
ord1581
ord5152
ord5214
ord5175
ord2991
ord3292
ord572
ord393
ord1794
ord3684
ord3596
ord4109
ord5529
ord631
ord1440
ord2280
ord386
ord4085
ord1489
ord2902
ord6118
ord299
ord2933
ord1482
ord6005
ord1185
ord5714
ord6006
ord5715
ord5493
ord2703
ord3201
ord380
ord722
ord760
ord530
ord2352
ord1917
ord907
ord5970
ord5111
ord421
ord2272
ord2131
ord3934
ord1439
ord3094
ord6288
ord5625
ord629
ord5089
ord384
ord3997
ord2271
ord4108
ord5284
ord655
ord2206
ord5287
ord5661
ord996
ord5107
ord2804
ord1151
ord1123
ord745
ord5490
ord557
ord3635
ord3595
ord5227
ord4569
ord570
ord759
ord2249
ord1740
ord6090
ord1395
ord934
ord930
ord932
ord928
ord923
ord5233
ord5235
ord5960
ord1600
ord4277
ord4722
ord3403
ord1306
ord2173
ord5205
ord4185
ord6275
ord5073
ord1908
ord5148
ord4244
ord1402
ord3945
ord1617
ord1620
ord5915
ord1557
ord4019
ord2424
ord2425
ord2992
ord5356
ord943
ord4904
ord2939
ord4135
ord4309
ord5012
ord5009
ord2615
ord1913
ord2246
ord3466
ord3648
ord781
ord876
ord304
ord310
ord2322
ord2468
ord784
ord5403
ord297
ord578
ord265
ord266
ord764
ord1207
ord368
ord4273

msvcr71

_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_amsg_exit
_acmdln
exit
_cexit
_ismbblead
_XcptFilter
_exit
_c_exit
??1type_info@@UAE@XZ
_onexit
__p__commode
__security_error_handler
memset
__p___argc
_except_handler3
free
atoi
sscanf
_setmbcp
rand
__p__fmode
__set_app_type
?terminate@@YAXXZ
__dllonexit
_controlfp
sprintf
getenv
time
srand
__CxxFrameHandler

kernel32

CreateMutexA
ReleaseMutex
GetVersionExA
CreateFileA
ReadFile
CloseHandle
GetLastError
CreateProcessA
lstrcmpA
DeleteFileA
CopyFileA
lstrlenA
GetVersion
SetThreadPriority
ResumeThread
InitializeCriticalSection
DeleteCriticalSection
ExitProcess
GetModuleHandleA
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
lstrcpyA
CreateDirectoryA

user32

PostMessageA
UpdateWindow
RegisterWindowMessageA
SendMessageA
EnableWindow

advapi32

RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey

comctl32

ord17

shlwapi

PathRemoveFileSpecA

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d9b63ea2511e343cf7b6aa363615dec7

Headers

File Characteristics

PDB Paths

Imports

netapi32

version

mfc71

msvcr71

kernel32

user32

advapi32

comctl32

shlwapi

Sections

.text Size: 19KB - Virtual size: 19KB

.rdata Size: 10KB - Virtual size: 9KB

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 9KB - Virtual size: 8KB

.text
Size: 19KB - Virtual size: 19KB

.rdata
Size: 10KB - Virtual size: 9KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 9KB - Virtual size: 8KB