add3c29d7699aa62321042a9ef38cdcc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

add3c29d7699aa62321042a9ef38cdcc_JaffaCakes118
Size

76KB
MD5

add3c29d7699aa62321042a9ef38cdcc
SHA1

8c7ab79ca96f6484f75edc672976e2c2040b7a87
SHA256

964eb9722a04f7ea137ebe8f0efad28ba15bc5af8c89699dfea5aae92f613959
SHA512

a11d1c6cbe96ee2fbe45461fe8aa3ba7365fb1df166515b0f9b3399ecde0c63c5cb97d706411e6ec15e14d60a21032ea715d7da77c85fb0a73106c86d0c9ffc1
SSDEEP

1536:OmyXujMswmxsxdujb8UAIouDGUTlKd1e1fo2rAgDKUczSG:ONMQWAK1fowbD2SG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
add3c29d7699aa62321042a9ef38cdcc_JaffaCakes118

Files

add3c29d7699aa62321042a9ef38cdcc_JaffaCakes118
.exe windows:4 windows x86 arch:x86

23618af826dd57de2566fd0f49300011

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

bc32fn

SetExEuro
SetPrintPageParms3
InvertDate
AllocLocalData
pvTerminateProgram
FreeLocalData
DBDatabase
DBClose
DBXAccess
BcxExit
GR
SkipRightBlk
ZPREXTEND
bPrintFileName
bGetActualArgsExv
ZEXVARG
PropertiesEx
ZTRADVER
ZMINVER
ZMINVERUX
pszCurrentModule
CallDllFunction2
SetString
ANNOEXT
BcMain2
FormatDouble
StrAdd
DefineOutputDev
bOptimizeSearch
iNewFrmSpec
pszSUBProto
psArgv
iArgc
CallAllPrograms
PROGC
ZNOMEXE

bc32ui

pszDecodMessage
EntryInitProgramData
CANVID
SetButtonCoupon2
SetEditConditions3
DBDefineStructs
DBCreateVars2
LoadControlStruct
SYSDATEXT
DefinePrintJob3
cRowsRI
cColsRI
RI
KYM
ExitInitProgramData
EntryTerminateProgram
DBRemoveVars
RCCHAN
WgsInitData
FreeBlob
ExitTerminateProgram
ZINIDEC
szProgramName
pszID
DefineWindow10
GetStyle
DefineFormat
DefineGroupBox3
DefineLabel3
DefineTVDouble
DefineComboOptions
DefineEdit11
DefineButton6
DefFuncKey3
DefineButtonIvt
RRI
RCI
ZDECOD
RunWindow6
ABC
ZVIDCOMPVIS
WgsRestoreInputData
BlobAdd
RCSRCH
SearchSTR
WgsExitAppThread
WgsInitID
TraceDebug2

kernel32

TerminateProcess
GetCurrentProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
GetProcAddress
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
VirtualAlloc
HeapReAlloc
LoadLibraryA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
ExitProcess

Sections

.text
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

23618af826dd57de2566fd0f49300011

Headers

File Characteristics

Imports

bc32fn

bc32ui

kernel32

Sections

.text Size: 52KB - Virtual size: 48KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 12KB - Virtual size: 13KB

.rsrc Size: 4KB - Virtual size: 948B

.text
Size: 52KB - Virtual size: 48KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 13KB

.rsrc
Size: 4KB - Virtual size: 948B