b58871ed6deb11dd0f7df3b9fc95b4ca_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b58871ed6deb11dd0f7df3b9fc95b4ca_JaffaCakes118
Size

588KB
MD5

b58871ed6deb11dd0f7df3b9fc95b4ca
SHA1

83b227520bdbd155f5a11e41dc9213d6984f49ea
SHA256

1ecf01dc38665c1c98077456d5fcc1db5e9c2b4a0b06801cfbf1dae1dbfadd8c
SHA512

1738c08bd2ac19585522f18ed568075a5a38175aaa0917da2ca20b91df6afc8387580f9ec54d56898fcf5042f82dbbdb49f862d45b3329ebdf11fdc28e98a506
SSDEEP

12288:3eaTrrhzote5z1V/Kaa8yo/Ee2NoypO5mYzlMCeSNTXzYp:1TrrhRna8se8puRtecTX8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b58871ed6deb11dd0f7df3b9fc95b4ca_JaffaCakes118

Files

b58871ed6deb11dd0f7df3b9fc95b4ca_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ea4bdb8369a426628e19a3f7acdaf57a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\work\dev\repos\clientserver\cubeversion\Client\bin\release\Updater.pdb

Imports

kernel32

GetModuleFileNameW
GetShortPathNameW
lstrcpyW
lstrcatW
GetEnvironmentVariableW
Sleep
ReleaseMutex
CreateMutexW
WaitForSingleObject
RemoveDirectoryW
MoveFileExW
DeleteFileW
FindFirstFileW
FindResourceExW
FindResourceW
SizeofResource
LoadResource
LockResource
FindNextFileW
FindClose
GetTempPathW
WideCharToMultiByte
WriteFile
MultiByteToWideChar
GetTempFileNameW
lstrlenW
lstrlenA
CloseHandle
GetTickCount
SetFileTime
GetSystemTime
GetVolumeInformationW
InterlockedIncrement
GetFileTime
SystemTimeToFileTime
GetSystemDirectoryW
InterlockedDecrement
GetLastError
GetVersion
DeviceIoControl
GetVersionExW
GetProcAddress
GetModuleHandleW
CreateEventW
HeapFree
GetProcessHeap
LoadLibraryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
GetStringTypeA
CreateFileW
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetCPInfo
GetSystemTimeAsFileTime
CreateFileA
GetCurrentProcessId
QueryPerformanceCounter
VirtualFree
GetConsoleMode
GetConsoleCP
GetStringTypeW
HeapDestroy
HeapAlloc
HeapReAlloc
HeapSize
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
SetFilePointer
VirtualAlloc
GetModuleHandleA
RtlUnwind
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
SetStdHandle

user32

UnregisterClassA

advapi32

RegSetValueExA
RegCreateKeyA
GetNamedSecurityInfoW
SetNamedSecurityInfoW
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

shell32

ShellExecuteW

shlwapi

SHDeleteKeyW

imagehlp

CheckSumMappedFile

Sections

.text
Size: 116KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 456KB - Virtual size: 455KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ea4bdb8369a426628e19a3f7acdaf57a

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

shlwapi

imagehlp

Sections

.text Size: 116KB - Virtual size: 112KB

.rdata Size: 456KB - Virtual size: 455KB

.data Size: 8KB - Virtual size: 13KB

.rsrc Size: 4KB - Virtual size: 2KB

.text
Size: 116KB - Virtual size: 112KB

.rdata
Size: 456KB - Virtual size: 455KB

.data
Size: 8KB - Virtual size: 13KB

.rsrc
Size: 4KB - Virtual size: 2KB