afcf50a7f37f6dede3bc1b85aed5011b_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

afcf50a7f37f6dede3bc1b85aed5011b_JaffaCakes118
Size

96KB
MD5

afcf50a7f37f6dede3bc1b85aed5011b
SHA1

e00c3f0e469e9f499813237d7d30f834d5c8361b
SHA256

cc949c566e487536c7113929f4b6da2b670178dd7124d2d794e556396b47b23e
SHA512

c8d97dc4dd6c5cc5415e66896a78cf7ed235c689d4231ffbe5871c510f41dc4eae673ce03f1274c356dba84b2268c200ebb9573ae0669a31c35d8d31ec3c8115
SSDEEP

1536:ICmwiBjuVw+QnoDBWHpUnxiS4q5CHQbsx/palzZS4IhqSq6QQQQppdHQQ:objErOq5C9x/palzZS4IUSr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
afcf50a7f37f6dede3bc1b85aed5011b_JaffaCakes118

Files

afcf50a7f37f6dede3bc1b85aed5011b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

02288e99bb5959c4b430fe9692b7701b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Develop\Firstlook\vclient\branches\Stable_branch_2008-02-28\src\blinkopt\Release\blinkopt.pdb

Imports

shlwapi

PathRemoveFileSpecA
PathAppendA
wnsprintfA

kernel32

FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
lstrcpyA
GetACP
GetLocaleInfoA
GetVersionExA
RaiseException
InitializeCriticalSection
DeleteCriticalSection
InterlockedExchange
SetStdHandle
LCMapStringW
LCMapStringA
GetSystemInfo
VirtualProtect
SetFilePointer
GetCPInfo
GetOEMCP
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
GetLastError
lstrlenA
FlushFileBuffers
CloseHandle
MultiByteToWideChar
RtlUnwind
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
ExitProcess
HeapFree
HeapAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
HeapReAlloc
TerminateProcess
GetCurrentProcess
HeapSize
VirtualQuery
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW

user32

DialogBoxParamA
ShowWindow
EndDialog
SendMessageA
GetDesktopWindow
GetWindowRect
SetWindowPos
SetWindowTextA
GetDlgItem
MessageBoxA
LoadIconA

advapi32

RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA

shell32

ShellExecuteA

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

02288e99bb5959c4b430fe9692b7701b

Headers

File Characteristics

PDB Paths

Imports

shlwapi

kernel32

user32

advapi32

shell32

Sections

.text Size: 40KB - Virtual size: 37KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 7KB

.shared Size: 4KB - Virtual size: 16B

.rsrc Size: 32KB - Virtual size: 28KB

.text
Size: 40KB - Virtual size: 37KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 7KB

.shared
Size: 4KB - Virtual size: 16B

.rsrc
Size: 32KB - Virtual size: 28KB