8c2b2ade1369e43bd6f28258ed750cde_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8c2b2ade1369e43bd6f28258ed750cde_JaffaCakes118
Size

61KB
MD5

8c2b2ade1369e43bd6f28258ed750cde
SHA1

49f51711dc71ce897be7d7cd9c2201f562855dd3
SHA256

a6ab4e7eec53d520ff489d09030a8c4a82e35659a3116d8b7b85eed46b951a57
SHA512

817b1f8be019af8efed42b731b6342b06d4c40f8c8d8bd4093f4e6fff6da44cd959b8c15be4f70b8c4392891ed6bab6edc8bd0654326a215b8bc681716911eb4
SSDEEP

1536:UvcsWewh/taY03A/SxAWASDYHh9O3ca1MraD7pj8/Fvl:+c/BGYjeAWF8zO3cauWDp8/3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8c2b2ade1369e43bd6f28258ed750cde_JaffaCakes118

Files

8c2b2ade1369e43bd6f28258ed750cde_JaffaCakes118
.exe windows:4 windows x86 arch:x86

12482e37c8d704905845894e1108404e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnterCriticalSection
GetCurrentThreadId
CloseHandle
GetCurrentProcessId
FlushInstructionCache
SetLastError
lstrcmpA
FreeLibrary
IsBadReadPtr
GetVersionExA
GetSystemDirectoryA
ExitProcess
WaitForSingleObjectEx
SetEvent
OpenEventA
InterlockedIncrement
WaitForSingleObject
DeleteCriticalSection
MapViewOfFile
UnmapViewOfFile
OpenFileMappingA
GetFileAttributesA
CreateFileMappingA
DeleteFileA
OutputDebugStringA
GetTickCount
GetProcAddress
VirtualFree
VirtualAlloc
MapViewOfFileEx
lstrcatA
SetThreadContext
VirtualProtectEx
GetThreadContext
ResumeThread
DuplicateHandle
LeaveCriticalSection
OpenProcess
CreateProcessA
Sleep
TerminateProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
VirtualAllocEx
VirtualFreeEx
QueryDosDeviceA
GetLogicalDriveStringsA
CreateThread
CopyFileA
GetWindowsDirectoryA
CreateEventA
CreateMutexA
ReleaseMutex
GetFileSize
CreateFileA
SetFileTime
GetFileTime
RemoveDirectoryA
WideCharToMultiByte
MultiByteToWideChar
ResetEvent
OpenFile
GlobalAlloc
GlobalFree
GetCurrentProcess
InitializeCriticalSection
lstrcpynA
HeapAlloc
lstrlenA
HeapReAlloc
GetLastError
lstrcpyA
HeapFree
GetProcessHeap
lstrcmpiA
VirtualQuery
VirtualProtect
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
CreateRemoteThread
LoadLibraryA

user32

wsprintfA
MessageBoxA
wvsprintfA

advapi32

InitializeSecurityDescriptor
AdjustTokenPrivileges
RegQueryValueExA
OpenProcessToken
GetTokenInformation
RegEnumValueA
RegOpenKeyExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
SetSecurityDescriptorDacl

oleaut32

SysAllocString
SysFreeString
VariantInit

wininet

HttpQueryInfoA
HttpOpenRequestA
InternetConnectA
InternetCanonicalizeUrlA
InternetOpenA
InternetReadFile
InternetQueryDataAvailable
InternetOpenUrlA
InternetCrackUrlA
InternetCloseHandle
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache
InternetQueryOptionA
HttpAddRequestHeadersA
InternetSetOptionA
HttpSendRequestA

rpcrt4

UuidToStringA
RpcStringFreeA
UuidCreate

urlmon

ObtainUserAgentString

Exports

Exports

Funzip@@YAPAXPADPAK@Z
InstallHook
_WorkProc@4
__mp@4

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.RPCrypt
Size: 475B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

12482e37c8d704905845894e1108404e

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

wininet

rpcrt4

urlmon

Exports

Exports

Sections

.text Size: 55KB - Virtual size: 55KB

.reloc Size: 5KB - Virtual size: 4KB

.RPCrypt Size: 475B - Virtual size: 4KB

.text
Size: 55KB - Virtual size: 55KB

.reloc
Size: 5KB - Virtual size: 4KB

.RPCrypt
Size: 475B - Virtual size: 4KB