b0c51d64e1d2a0b7175edad6a346b323_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b0c51d64e1d2a0b7175edad6a346b323_JaffaCakes118
Size

187KB
MD5

b0c51d64e1d2a0b7175edad6a346b323
SHA1

0fa0f54d0c51efc59f26862a0f9e4565ec44fc0e
SHA256

27ebeed86e614f8906607f615f8fe3ea4821584c4bf15377adaec44467fb7028
SHA512

d4012de8b97f50bf167ace9a6085f95217868e97363e72bf4ffcefa0f264f428a3c7a5f2c778fc39928292e58ccb08176d9bd340f2bbdfad8802b06394b0c3d4
SSDEEP

3072:VktT8BwXnpgXsWj1czLWVm71cvxIxH0+vWNBO65i0I91uev+LOrPtw9RlfnsyhGy:s8BwXgs3fU4cpa08+5C3GKrP+3lfsyhY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b0c51d64e1d2a0b7175edad6a346b323_JaffaCakes118

Files

b0c51d64e1d2a0b7175edad6a346b323_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5f8975336301a5caa84889f0f1eadd39

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempPathA
GlobalLock
GlobalAlloc
FindFirstVolumeMountPointW
GlobalReAlloc
GlobalSize
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
LocalAlloc
LocalFree
CreateFileA
lstrcmpA
GetFileAttributesA
GetProcAddress
GetModuleFileNameA
GetTempPathA
DeleteFileA
CloseHandle
GetCurrentDirectoryA
GetLocalTime
FindClose
FindNextFileA
FindFirstFileA
EnumResourceLanguagesA
WideCharToMultiByte
ReadFile
WriteFile
SetFilePointer
GlobalHandle
IsDBCSLeadByte
GetModuleHandleA
VirtualProtect
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcessHeap
GetModuleHandleW
CreateProcessA
GetTempFileNameA
HeapFree
HeapAlloc
LoadLibraryW
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
GlobalFree
GlobalUnlock
GetCurrentThread
lstrlenA
MulDiv
MultiByteToWideChar
FreeLibrary
RaiseException
LoadLibraryA
FormatMessageA
GetSystemDirectoryW
LoadLibraryExW
GetTickCount
GetLocaleInfoA
GetCPInfo
SetErrorMode
GetSystemDefaultLangID
GetVersion
lstrcmpiA
GetACP
GetSystemDirectoryW
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
TlsGetValue
TlsSetValue
CreateMutexW
ReleaseMutex
WaitForSingleObject

user32

SetWindowLongA
DefWindowProcA
DestroyWindow
GetScrollPos
SetScrollRange
GetWindowLongA
GetParent
BringWindowToTop
GetScrollRange
UpdateWindow
ScrollWindow
SetScrollPos
GetClientRect
IntersectRect
OffsetRect
ShowCursor
MessageBeep
GetCapture
GetCursorPos
WindowFromPoint
SetCursor
SendMessageA
GetClassInfoExA

comctl32

PropertySheetA

comdlg32

GetOpenFileNameA
ChooseFontA
GetSaveFileNameA
CommDlgExtendedError

advapi32

RegQueryValueExW
RegEnumValueA
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyExW

ole32

OleUninitialize
BindMoniker
CoCreateInstance
OleInitialize
CoGetMalloc
StringFromGUID2

shlwapi

wnsprintfA

oleaut32

DispGetIDsOfNames
DispGetIDsOfNames
VarUI4FromDec
SetErrorInfo

Sections

.text
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 318B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5f8975336301a5caa84889f0f1eadd39

Headers

File Characteristics

Imports

kernel32

user32

comctl32

comdlg32

advapi32

ole32

shlwapi

oleaut32

Sections

.text Size: 147KB - Virtual size: 147KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 34KB - Virtual size: 33KB

.reloc Size: 512B - Virtual size: 318B

.text
Size: 147KB - Virtual size: 147KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 34KB - Virtual size: 33KB

.reloc
Size: 512B - Virtual size: 318B