a000b25c4e6addda22db2814b2122f3f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a000b25c4e6addda22db2814b2122f3f_JaffaCakes118
Size

36KB
MD5

a000b25c4e6addda22db2814b2122f3f
SHA1

dcc9b371a6ebbeba824c28397e11568ed37b6a7f
SHA256

dc1b448bf31fa880d0d58f82035b2556d41a95d7f6ada08d598db656fcd840da
SHA512

9cfe14be1686a0f95dafeaebd01543bb884f8b11dac1ec6cf0516f482851c2edd6b5d0aad7049518985bfdc6f4f7447a18033ec06c28340d294ac413a289aa78
SSDEEP

384:TzuDQh+SuEFD5b0nAo37zjkZl+9lhPUrw4NZhwxmq:GQh+SBFy178+9LsrTN7wxmq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a000b25c4e6addda22db2814b2122f3f_JaffaCakes118

Files

a000b25c4e6addda22db2814b2122f3f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7c03ec906db98497849e01f362a5e654

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord3825
ord3079
ord4080
ord4627
ord4425
ord3597
ord800
ord801
ord641
ord860
ord540
ord541
ord326
ord825
ord4234
ord924
ord537
ord939
ord941
ord535
ord4129
ord5683
ord926
ord2764
ord5572
ord2915
ord858
ord668
ord1980
ord4278
ord3178
ord3181
ord4058
ord2781
ord2770
ord5710
ord356
ord3831
ord2818
ord4202
ord5861
ord6883
ord798
ord4204
ord1997
ord5465
ord5778
ord3318
ord5194
ord533
ord6407
ord2379
ord561
ord815
ord2820
ord3811
ord551
ord2763
ord1575
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5280
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1775
ord4078
ord6052
ord2514
ord4998
ord4853
ord4376
ord922
ord5265

msvcrt

_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
__p__commode
_onexit
__dllonexit
atoi
_mbscmp
getenv
__CxxFrameHandler
__p__fmode
__set_app_type
_except_handler3
_exit
_controlfp

kernel32

GetModuleHandleA
MoveFileA
GetModuleFileNameA
lstrlenA
DeleteFileA
MultiByteToWideChar
CloseHandle
Process32Next
OpenProcess
WinExec
TerminateProcess
Process32First
CreateToolhelp32Snapshot
SetFileAttributesA
GetFileAttributesA
Sleep
GetCommandLineA
GetTempPathA
CopyFileA

user32

EnableWindow

advapi32

InitializeAcl
LookupAccountNameA
AddAccessAllowedAce
SetNamedSecurityInfoA
RegDeleteValueA
RegCreateKeyExA
RegEnumKeyExA
RegEnumValueA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
AllocateAndInitializeSid

ole32

CoCreateInstance
CoInitialize
CoUninitialize

msvcp60

??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7c03ec906db98497849e01f362a5e654

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

advapi32

ole32

msvcp60

Sections

.text Size: 16KB - Virtual size: 14KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 16B

.text
Size: 16KB - Virtual size: 14KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 16B