aa351dceea4c17cc7c7264ea160e9c60_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

aa351dceea4c17cc7c7264ea160e9c60_JaffaCakes118
Size

200KB
MD5

aa351dceea4c17cc7c7264ea160e9c60
SHA1

34d3196d9757de7ccd647a4af0ed670d61793c9c
SHA256

fabc1e7a80623086ba49a005717885bbab255ed577b490239d54dd6d081e897c
SHA512

8cea43b18a43717a8f9ed320fb093307ceb698d03b112e5dcc8a8fcc793e0c5a512920a613f62b74264a1e5bb2cf3725f8dedc2baac1504b7bce633361343135
SSDEEP

3072:a1gimpR8SOCMgs7YTIPCK0UMIcUe32WO+7Q1Iy9637SSU:aVxSOCMTGIPCC9cUm27+qI1Ls

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa351dceea4c17cc7c7264ea160e9c60_JaffaCakes118

Files

aa351dceea4c17cc7c7264ea160e9c60_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f5f252e3f5d25c726ffa2ff6e76d1939

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc80u

ord1178
ord762
ord577
ord1479
ord870
ord2895
ord282
ord6700
ord6111
ord3383
ord774
ord776
ord283
ord280
ord287
ord2444
ord1182
ord764
ord5558
ord5524
ord1476
ord293
ord2311
ord3927
ord777

msvcr80

?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
__CxxFrameHandler3
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
??1exception@std@@UAE@XZ
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_amsg_exit
__wgetmainargs
_cexit
??0exception@std@@QAE@XZ
toupper
_invalid_parameter_noinfo
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
free
__wargv
__argc
_wsplitpath
_itoa
wcstoul
_vswprintf
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_encode_pointer
_swprintf

kernel32

LoadLibraryA
GetProcAddress
GetLocaleInfoA
GetACP
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
GetTempPathW
GetCurrentProcessId
RemoveDirectoryW
CreateDirectoryW
CreateMutexW
WaitForSingleObject
ReleaseMutex
UnmapViewOfFile
CloseHandle
CreateFileMappingW
GetLastError
GetTickCount
OpenFileMappingW
MapViewOfFile
DeleteFileW
GetModuleHandleW
FindResourceW
SizeofResource
LoadResource
LockResource
MultiByteToWideChar
GetVersionExA
FindNextFileW
FindFirstFileW
FindClose

user32

wsprintfW
LoadStringW
MessageBoxW

winspool.drv

ord203

shell32

SHGetFolderPathW

ole32

CoCreateInstance
StringFromGUID2
CoInitialize

oleaut32

VarBstrCmp
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysAllocStringLen
SysFreeString

msvcp80

??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 124KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f5f252e3f5d25c726ffa2ff6e76d1939

Headers

File Characteristics

Imports

mfc80u

msvcr80

kernel32

user32

winspool.drv

shell32

ole32

oleaut32

msvcp80

Sections

.text Size: 40KB - Virtual size: 38KB

.rdata Size: 28KB - Virtual size: 26KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 124KB - Virtual size: 121KB

.text
Size: 40KB - Virtual size: 38KB

.rdata
Size: 28KB - Virtual size: 26KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 124KB - Virtual size: 121KB