8ebcd70872ddc3f0e5cf922c8fc74d5e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8ebcd70872ddc3f0e5cf922c8fc74d5e_JaffaCakes118
Size

39KB
MD5

8ebcd70872ddc3f0e5cf922c8fc74d5e
SHA1

0a18042b76e0c85c2f2d056950aef902b9b2b099
SHA256

2571537d8746bdf653643cf0f3f6331145988282ffe446d64df4f9c8060fdfce
SHA512

e41147e267263d8b8f5773a01dfa17a2836bf89c78da1d47151b088b725908f7688e8e4d6f5fbd1a1bde8d2b93dceb1fb26199b72d363764b120408189c66f39
SSDEEP

384:rqNWfviE7AoFN05nieC/3td431Xeb8Mp7e2BQH0lZAm49RUnd8Pko3:rqNpKA4qiP/9KlXW8MZeUZhWU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8ebcd70872ddc3f0e5cf922c8fc74d5e_JaffaCakes118

Files

8ebcd70872ddc3f0e5cf922c8fc74d5e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5d4b3146d805d6db8adb3e1c835936c4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
CreateProcessA
CloseHandle
GetStartupInfoA
GetLastError
DeleteFileA
GetTickCount
GetLocalTime
GetCurrentProcessId
GetFileTime
FindCloseChangeNotification
FindNextChangeNotification
FindFirstChangeNotificationA
DeviceIoControl
GetCurrentProcess
LoadLibraryA
SetTapePosition
lstrcmpiA
GetModuleHandleA

user32

FrameRect
ClientToScreen
RegisterClassExA
GetWindowTextLengthA
MapDialogRect
LoadIconA
SetCapture
OffsetRect
EndDialog
CloseClipboard
GetMessageA
SystemParametersInfoA
ScreenToClient

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter
GetJobA

shlwapi

SHGetValueA
StrChrA
PathFindFileNameA
UrlCanonicalizeA
UrlCreateFromPathA
UrlApplySchemeA

ole32

OleCreate
CoInitialize
StgCreateDocfile
CoUninitialize
OleUninitialize
OleInitialize
CoSuspendClassObjects

ws2_32

accept
bind
closesocket
connect
socket
gethostbyaddr

wininet

InternetOpenUrlA
InternetCanonicalizeUrlA
InternetSetOptionExA
InternetQueryDataAvailable
HttpQueryInfoA
InternetSetFilePointer
InternetWriteFile
InternetReadFile
HttpSendRequestA
InternetConnectA
HttpOpenRequestA
InternetCloseHandle
InternetOpenA
InternetCrackUrlA

msvcrt

_ltoa
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
strlen
atol
time
_strcmpi

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 178B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5d4b3146d805d6db8adb3e1c835936c4

Headers

File Characteristics

Imports

kernel32

user32

winspool.drv

shlwapi

ole32

ws2_32

wininet

msvcrt

Sections

.text Size: 8KB - Virtual size: 5KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 107KB

.rsrc Size: 16KB - Virtual size: 13KB

.reloc Size: 512B - Virtual size: 178B

.text
Size: 8KB - Virtual size: 5KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 107KB

.rsrc
Size: 16KB - Virtual size: 13KB

.reloc
Size: 512B - Virtual size: 178B