b1950a118cf101835316c2cfa1ae0b04_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b1950a118cf101835316c2cfa1ae0b04_JaffaCakes118
Size

201KB
MD5

b1950a118cf101835316c2cfa1ae0b04
SHA1

4ca758f2cec9d67fac3cb52561115d9db68fd6ef
SHA256

9ad31241c44669cc8974e284caf50d17151c301136c2884679738d2d3ac27869
SHA512

25e94a8af0964f2f15c5437c9687ee0877fc57e2668cd0849b3de734a9c3acf82a8d7f140a73d5816b2dfe6950fb75f8cc7a71ee745de942f83ec6c9a59f5a90
SSDEEP

3072:6kv+pIH2jPJcgOvEtwC68twjIqfu+WXhUZrazHecpuI6pVA1X+czkoa6wOhadSCK:ja+gO8tu8tw8bp6OvYujfh0SHlunIj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b1950a118cf101835316c2cfa1ae0b04_JaffaCakes118

Files

b1950a118cf101835316c2cfa1ae0b04_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0dee6128400ce4967b64af3c8f2d5189

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeaps
GetCurrentDirectoryA
ExpandEnvironmentStringsA
GetSystemDirectoryA
CreateDirectoryW
GetModuleHandleA
GetCurrentProcessId
GlobalDeleteAtom
WriteFile
lstrcmpA
CopyFileA
LocalAlloc
SetComputerNameW
SetLastError
GetFullPathNameA
GetCPInfo
GetStartupInfoW
GetExitCodeProcess
GetExpandedNameW
CreateNamedPipeA
GetVersionExA
GetProcAddress
OpenMutexA
IsBadStringPtrW
lstrcpynW
EnumCalendarInfoW
SearchPathW
lstrcmpiW
GetUserDefaultLangID
Sleep
GetProcessHeap
lstrcatA
BeginUpdateResourceW
DeleteAtom
CreateFileA
GlobalFindAtomW
GetExitCodeThread

user32

GetCapture
SetWindowTextW
GetMenuItemRect
MessageBoxW
GetCursorPos
GetAsyncKeyState
MonitorFromRect
CallWindowProcA
ArrangeIconicWindows
CloseWindow
CharUpperA
BringWindowToTop
GetSysColor
RegisterClassExW
GetClassInfoExA
GetDC
DefWindowProcW
MessageBoxIndirectA
MoveWindow
GetForegroundWindow
PeekMessageA
LoadIconW
GetDlgItem
MonitorFromWindow
EnumDesktopsA
CharPrevW
ShowCaret
GetCaretPos

gdi32

GetGraphicsMode
SetRectRgn
GetEnhMetaFileA
CreateMetaFileA
CreateFontIndirectExW
GetEnhMetaFilePaletteEntries
GetOutlineTextMetricsW
ScaleViewportExtEx
BeginPath
GetCharWidthW
DeleteEnhMetaFile
SetStretchBltMode

advapi32

RegOpenKeyW
RegFlushKey
RegEnumValueA
RegCreateKeyExW
RegOpenKeyA
RegQueryValueA
RegRestoreKeyW

shell32

StrNCmpIW
ShellExecuteExA
StrNCmpA

oleaut32

VarDecSub
VarI1FromDec
VarUI1FromR4
VarI4FromR4
VarR8FromI4
VarI1FromStr
DllRegisterServer

version

GetFileVersionInfoW
VerInstallFileA
VerFindFileA

urlmon

CreateFormatEnumerator
CDLGetLongPathNameA
CoInternetQueryInfo
IsAsyncMoniker
URLDownloadToFileW
GetSoftwareUpdateInfo
URLDownloadA
Extract
IsLoggingEnabledA
CopyStgMedium

crypt32

CertSetCTLContextProperty
CryptMsgVerifyCountersignatureEncoded
CertUnregisterPhysicalStore
CryptExportPublicKeyInfo
CertSaveStore
CryptRegisterOIDInfo
I_CryptAllocTls
CryptSIPVerifyIndirectData
CryptMsgEncodeAndSignCTL

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.IcbOWV
Size: 2KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fwV
Size: 3KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.CgwTKx
Size: 1024B - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zR
Size: 1024B - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ZKF
Size: 1024B - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Rkacex
Size: 2KB - Virtual size: 269KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0dee6128400ce4967b64af3c8f2d5189

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

oleaut32

version

urlmon

crypt32

Sections

.text Size: 12KB - Virtual size: 12KB

.IcbOWV Size: 2KB - Virtual size: 9KB

.fwV Size: 3KB - Virtual size: 14KB

.CgwTKx Size: 1024B - Virtual size: 23KB

.data Size: 5KB - Virtual size: 4KB

.zR Size: 1024B - Virtual size: 30KB

.ZKF Size: 1024B - Virtual size: 31KB

.Rkacex Size: 2KB - Virtual size: 269KB

.rsrc Size: 170KB - Virtual size: 170KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 12KB - Virtual size: 12KB

.IcbOWV
Size: 2KB - Virtual size: 9KB

.fwV
Size: 3KB - Virtual size: 14KB

.CgwTKx
Size: 1024B - Virtual size: 23KB

.data
Size: 5KB - Virtual size: 4KB

.zR
Size: 1024B - Virtual size: 30KB

.ZKF
Size: 1024B - Virtual size: 31KB

.Rkacex
Size: 2KB - Virtual size: 269KB

.rsrc
Size: 170KB - Virtual size: 170KB

.reloc
Size: 1KB - Virtual size: 1KB