8df1b7c49ce6675e880bbb21a78ec569_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8df1b7c49ce6675e880bbb21a78ec569_JaffaCakes118
Size

284KB
MD5

8df1b7c49ce6675e880bbb21a78ec569
SHA1

9f56a6f7f47820a470c897645787868538d73c9b
SHA256

aeebf84dce43904eb8952ae2b1b41ac46a26cc975b701a45cf8c5b11b75a7f03
SHA512

77d1f1e784749194ddb12b7558160405811368f8685de9894e27592a677d364b2b83c55bb286f5a95a1788aff4ef2b9f111291a8d2e4f6027733cc3b0de55042
SSDEEP

6144:NcRicTpmOCbevYyqH/Q3kE1PTfFdiMgQ8HXnDKqoXqOA:m3mwvBqH/3E1bLiMN8H

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8df1b7c49ce6675e880bbb21a78ec569_JaffaCakes118

Files

8df1b7c49ce6675e880bbb21a78ec569_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dd800852a055c65e5e354c88e9b752c2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Documents and Settings\admin\My Documents\Visual Studio 2005\Projects\popup\release\POPUP.pdb

Imports

kernel32

GlobalUnlock
GlobalFree
GetModuleHandleA
CreateMutexA
Sleep
GlobalLock
LoadLibraryA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
HeapSize
GlobalAlloc
LoadResource
LockResource
SizeofResource
FindResourceA
GetLastError
CloseHandle
CreateProcessA
ExpandEnvironmentStringsA
GetModuleFileNameA
SetEndOfFile
GetTickCount
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
HeapReAlloc
VirtualAlloc
FlushFileBuffers
SetStdHandle
InitializeCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
RaiseException
RtlUnwind
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
SetFilePointer
MultiByteToWideChar
ReadFile
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
ExitProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
CreateFileA

user32

PeekMessageA
TranslateMessage
DispatchMessageA
BeginPaint
EndPaint
GetWindowLongA
LoadCursorA
DefWindowProcA
RegisterClassExA
CreateWindowExA
SetWindowLongA
GetSystemMetrics
MoveWindow
ShowWindow

gdi32

DeleteObject
BitBlt
SelectObject
CreateCompatibleDC
DeleteDC

advapi32

RegOpenKeyExA
RegSetValueExA
GetUserNameA
RegCloseKey
RegQueryValueExA

ole32

CreateStreamOnHGlobal

gdiplus

GdipCreateBitmapFromStream
GdiplusStartup
GdipGetImageWidth
GdipDisposeImage
GdipGetImageHeight
GdipCreateHBITMAPFromBitmap
GdipFree
GdipAlloc
GdipCloneImage

Sections

.text
Size: 76KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 180KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dd800852a055c65e5e354c88e9b752c2

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

ole32

gdiplus

Sections

.text Size: 76KB - Virtual size: 74KB

.rdata Size: 16KB - Virtual size: 14KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 180KB - Virtual size: 178KB

.text
Size: 76KB - Virtual size: 74KB

.rdata
Size: 16KB - Virtual size: 14KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 180KB - Virtual size: 178KB