a8eb90a2c5457ce06d173bb2a320efc8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a8eb90a2c5457ce06d173bb2a320efc8_JaffaCakes118
Size

1.4MB
MD5

a8eb90a2c5457ce06d173bb2a320efc8
SHA1

5a1862a03e49b7838a9cb6a29da6eb70762efcc1
SHA256

3428ff08f280ad63d96ca3be52ece194da5a1da2468db6c70fd4179b3d2d9aaa
SHA512

918385815d4d4965968ab0b461f6c33eddb98d935fd9b84db7793d9a48db50d5fbf5d8681281785c0cb858deadb20289188f512e1b73053c417f171ba3b46a0c
SSDEEP

24576:8AzMrQifgJw62/JfuKo0Ud6zpAoFmI53OceoiKJ634hRFO7k2jG9f4gVJjsG:8vfewdJfo7osMecbiKVE7bjifzh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a8eb90a2c5457ce06d173bb2a320efc8_JaffaCakes118

Files

a8eb90a2c5457ce06d173bb2a320efc8_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f9fcc81626febf9189c63399d737523a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

EqualRect
FillRect
IsCharLowerA
LoadAcceleratorsA
LoadBitmapA
LoadCursorFromFileA
LoadImageA
MessageBeep
OemToCharBuffA
PostMessageA
SendMessageA
UpdateWindow
EmptyClipboard
EndDialog

version

GetFileVersionInfoW
VerFindFileW
VerInstallFileW
VerQueryValueW
GetFileVersionInfoA

kernel32

WinExec
VerLanguageNameW
VerLanguageNameA
UnlockFileEx
TerminateProcess
SetLastError
SetFilePointer
SetCurrentDirectoryA
SetCommState
SetCommMask
SetCommBreak
SearchPathA
ReplaceFileA
QueryPerformanceFrequency
DeleteFileA
DuplicateHandle
EnumDateFormatsW
EnumResourceLanguagesW
ExitProcess
FindFirstFileExA
FindFirstVolumeW
FindResourceW
FlushFileBuffers
GetCommandLineA
GetCurrentThreadId
GetDefaultCommConfigW
GetFileSize
GetLastError
GetLocalTime
GetProcAddress
GetTapePosition
GetThreadLocale
GetTickCount
GetVersionExW
HeapAlloc
IsBadReadPtr
IsBadStringPtrA
IsDBCSLeadByte
ProcessIdToSessionId

ntdll

RtlUpcaseUnicodeStringToOemString
RtlxOemStringToUnicodeSize
ZwAccessCheck
ZwCompleteConnectPort
ZwCreateIoCompletion
RtlTimeToElapsedTimeFields
RtlStringFromGUID
RtlSetInformationAcl
RtlSetCurrentDirectory_U
RtlResetRtlTranslations
RtlNtStatusToDosError
RtlMultiByteToUnicodeN
RtlLargeIntegerShiftLeft
RtlIsNameLegalDOS8Dot3
RtlInsertElementGenericTable
RtlInitAnsiString
RtlImpersonateSelf
RtlEqualDomainName
RtlDelete
RtlCreateUserProcess
NtGetWriteWatch
NtMapUserPhysicalPagesScatter
NtPowerInformation
NtPrivilegeObjectAuditAlarm
NtQueryPerformanceCounter
NtSetHighEventPair
RtlTraceDatabaseFind

userenv

CreateEnvironmentBlock
RegisterGPNotification
GetAppliedGPOListW
FreeGPOListW
ExpandEnvironmentStringsForUserW
EnterCriticalPolicySection

Exports

Exports

ImnkQzsZ
NagdYe
Olbiuw
UyxsmsdbAyTbBw
audaknajl
bhcyYckPkvtxrisewul
enuiWtniyeuscidJvwb
ezosyqirXhswcMtwgb
ftmjBpltpcAYunck
hiJxh
lqaybflInvvlIoi
nmthKlfLxpXIabxf
qAlchjufoHpeeF
qbtjsjqveQsNnEglyhr
qsjmpHtzidaer
sBbqeviiBaan
vvvEjtwioudjzltwlop
vzdNpcswce

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 487KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f9fcc81626febf9189c63399d737523a

Headers

File Characteristics

Imports

user32

version

kernel32

ntdll

userenv

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 56KB

.data Size: 487KB - Virtual size: 1.1MB

.rsrc Size: 51KB - Virtual size: 51KB

.text
Size: 56KB - Virtual size: 56KB

.data
Size: 487KB - Virtual size: 1.1MB

.rsrc
Size: 51KB - Virtual size: 51KB