878778457e3527d30f155ba046456697_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

878778457e3527d30f155ba046456697_JaffaCakes118
Size

129KB
MD5

878778457e3527d30f155ba046456697
SHA1

2a7ca8a754d1c7d4e114363f7ce6c025aa2e42f0
SHA256

db72b93f8f2f64d0bedc029274408ebf03702827df49a734a65500e2a42f5e2a
SHA512

dc482dd14022ca6f4e53928dbefadf3a81d064c06a7258a2e1963b3c25c18dd760c3e47aa37db2c65b2e331201e8d4eeb09fef67a689ed0e2179f41b8409cf5d
SSDEEP

3072:FiZjqeJbvcYWa5L6pf5XaFmTa7F++PRFBkbq8GhmZE2fAl+/UBro22oSBVu70YLQ:wZjqeJbvJhw+4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
878778457e3527d30f155ba046456697_JaffaCakes118

Files

878778457e3527d30f155ba046456697_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f61c9957ecd575baa0267b75896c458d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\pulse\recipes\235503902\base\branches\omaha_blue_release_branch\googleclient\omaha\build\opt\obj\google_update\GoogleUpdate_unsigned_exe.pdb

Imports

kernel32

RaiseException
LoadLibraryExW
VerifyVersionInfoW
GetModuleHandleW
SizeofResource
VerSetConditionMask
LockResource
GetLastError
FindResourceExW
FindResourceW
GetProcAddress
lstrlenW
GetCommandLineW
GetFileAttributesExW
FreeLibrary
GetModuleFileNameW
LoadResource
SystemTimeToFileTime
GetSystemTime
CompareFileTime
SetLastError
LocalAlloc
CloseHandle
SetStdHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
WideCharToMultiByte
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
RtlUnwind
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InterlockedExchange
LoadLibraryA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
CreateFileA

ole32

CoCreateGuid

Sections

.text
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f61c9957ecd575baa0267b75896c458d

Headers

File Characteristics

PDB Paths

Imports

kernel32

ole32

Sections

.text Size: 65KB - Virtual size: 64KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 57KB - Virtual size: 57KB

.text
Size: 65KB - Virtual size: 64KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 57KB - Virtual size: 57KB