a05d018c4113579392d316c642831fd9_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

a05d018c4113579392d316c642831fd9_JaffaCakes118
Size

53KB
MD5

a05d018c4113579392d316c642831fd9
SHA1

263a623e269437400ddb71ae4be2caedbb326aa5
SHA256

a7c68a5dc4eb99f47fd1f545e74be1750f893b062097aea6cbcfda519fbca9f3
SHA512

20cb8597ca5f20f9b51a040365ee001503bafae6bf3cc7728a6b21410cf6487cb6281837a4bebc4c8036f44dfcad6a1d4e23b61472ff7442f0835b65e1b31b6b
SSDEEP

1536:yWJVrjzvyWjxgrILe4xmpLI25vJNktrCTlao4UQk:yWJVrjzXLrcPNYo4I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a05d018c4113579392d316c642831fd9_JaffaCakes118

Files

a05d018c4113579392d316c642831fd9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0e9ff18bd2073706b34d579a8ad780d6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord3215
ord5201
ord5207
ord389
ord825
ord5651
ord5356
ord690
ord665
ord800
ord1979
ord5186
ord860
ord540
ord350
ord354
ord1988
ord3616
ord3663
ord823
ord3127

msvcrt

_strnicmp
toupper
free
malloc
memmove
strchr
fclose
fprintf
fopen
_purecall
fputs
isspace
isalnum
isalpha
tolower
_ltoa
_stricmp
_strcmpi
strcmp
_tzset
time
sprintf
_strupr
rand
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
strcat
_strlwr
strncpy
exit
strcpy
strstr
strncmp
atoi
memcpy
__CxxFrameHandler
strlen
memset
localtime

kernel32

_lclose
GetModuleFileNameA
MoveFileExA
GetWindowsDirectoryA
lstrcatA
GetFileSize
_hread
_lopen
_llseek
UnmapViewOfFile
SetFilePointer
SetEndOfFile
LoadLibraryA
OpenProcess
TerminateProcess
FreeLibrary
MapViewOfFile
CreateFileMappingA
GlobalFree
SetFileTime
GetVersionExA
Sleep
DeleteFileA
FindClose
FindFirstFileA
CopyFileA
SetFileAttributesA
ResumeThread
CreateThread
CloseHandle
GetLastError
CreateMutexA
GetProcAddress
GetModuleHandleA
GetStartupInfoA
CreateFileA
GlobalAlloc
FindResourceA
LoadResource
SystemTimeToFileTime
LocalFileTimeToFileTime
lstrcpyA
HeapAlloc
GetProcessHeap
LockResource
SizeofResource
MultiByteToWideChar
RemoveDirectoryA
CreateDirectoryA
lstrlenA
GetCommandLineA
GetVolumeInformationA

user32

SendMessageA
MessageBoxA
wsprintfA
GetMessageA
TranslateMessage
DispatchMessageA
EnumWindows
EnumChildWindows

advapi32

RegDeleteKeyA
RegEnumValueA
RegQueryInfoKeyA
RegSetValueExA
RegDeleteValueA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegCreateKeyA

shell32

ShellExecuteA
SHGetPathFromIDListA
SHGetSpecialFolderLocation

winmm

timeGetTime

ole32

CoTaskMemFree
CoCreateInstance
CoInitialize

rasapi32

RasEnumDevicesA
RasGetEntryDialParamsA
RasGetEntryPropertiesA

Sections

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0e9ff18bd2073706b34d579a8ad780d6

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

advapi32

shell32

winmm

ole32

rasapi32

Sections

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 40KB - Virtual size: 46KB

.rsrc Size: 3KB - Virtual size: 4KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 40KB - Virtual size: 46KB

.rsrc
Size: 3KB - Virtual size: 4KB