8787477b9bf9c4d75781a135e872275c_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

8787477b9bf9c4d75781a135e872275c_JaffaCakes118
Size

392KB
MD5

8787477b9bf9c4d75781a135e872275c
SHA1

44a6f6a7cd9e1c9b23a89d5f284136a5f5a97274
SHA256

19929af3273fdb88116aa798f8ee49c0709f9a08528d8ffb4e0b97c6a7eda5af
SHA512

a944989b7dd0eb8c72df5885865dabe6d1147f8f25d9b06dc177b2a29a02201453b20f8f2f6e20aaff1759a7dbcd6b4792dc009149ca6f79b42d1ce2870192f3
SSDEEP

12288:vyBXXpHDj4lZ3WmSvGCr+xSEHVShJoEseW:vyPHH4lZ3RYG/x31ShCeW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8787477b9bf9c4d75781a135e872275c_JaffaCakes118

Files

8787477b9bf9c4d75781a135e872275c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1fd4e6f8a8da7dbdf267481f09d826f4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
HeapFree
HeapAlloc
GetCommandLineA
CloseHandle
VirtualProtectEx
GetSystemInfo
UnlockFile
WriteFile
LockFile
GetModuleHandleA
ReadFile
CreateFileA
VirtualQuery
VirtualProtect
RtlUnwind
GetProcAddress
IsBadWritePtr
VirtualAlloc
HeapCreate
SetFilePointer
GetSystemTime
GetLocaleInfoA
GetStringTypeW
GetStartupInfoA
GetVersionExA
ExitProcess
TerminateProcess
GetCurrentProcess
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsFree
SetLastError
GetCurrentThreadId
TlsSetValue
TlsGetValue
TlsAlloc
HeapDestroy
VirtualFree
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
InitializeCriticalSection
HeapReAlloc
HeapSize
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA

user32

UpdateWindow
GetTopWindow
OpenIcon
LoadCursorA
DispatchMessageA
IsZoomed
wsprintfA

gdi32

FloodFill
CreateSolidBrush

advapi32

ConvertSidToStringSidW
ConvertStringSidToSidW

psapi

EnumProcessModules
GetWsChanges
EmptyWorkingSet
GetModuleInformation

msvfw32

DrawDibTime

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 168KB - Virtual size: 563KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 116KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1fd4e6f8a8da7dbdf267481f09d826f4

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

psapi

msvfw32

Sections

.text Size: 96KB - Virtual size: 95KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 168KB - Virtual size: 563KB

.rsrc Size: 116KB - Virtual size: 112KB

.text
Size: 96KB - Virtual size: 95KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 168KB - Virtual size: 563KB

.rsrc
Size: 116KB - Virtual size: 112KB