b381a88f39b1fa2858a60122b861007c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b381a88f39b1fa2858a60122b861007c_JaffaCakes118
Size

123KB
MD5

b381a88f39b1fa2858a60122b861007c
SHA1

05a675d6d43d47b3dda99851cccd6ac218e69788
SHA256

6c8479310da62800bfeebb67a92f5feeed342be7d6b4d3e9642a2cd7d146e3a0
SHA512

60604071209719d633603b6b948786c3091439adb3261dd13019a4759ac63f8af432927d92b61b156ba8c9ba1efd8af7e9debfc09ec9345495b8af90a7a41a37
SSDEEP

3072:a3HaVSstEFijkRX2XiZyrWgyEZtxVD1Q31VX:aKVpEcrnrBQ31V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b381a88f39b1fa2858a60122b861007c_JaffaCakes118

Files

b381a88f39b1fa2858a60122b861007c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8adcefe74eddb64e0e1d1851b13609e7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
FreeSid
CheckTokenMembership
AllocateAndInitializeSid

user32

GetDesktopWindow
GetWindowRect
wsprintfA

ole32

CoCreateGuid
StringFromGUID2

oleaut32

SysAllocStringLen

ws2_32

WSAGetLastError
WSAStartup
WSCUnInstallNameSpace

kernel32

GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
lstrcpyW
lstrlenA
MultiByteToWideChar
GetProcAddress
GetModuleHandleA
lstrcpynA
WideCharToMultiByte
lstrcatA
lstrcpyA
ExpandEnvironmentStringsA
VerLanguageNameA
GetSystemDefaultLangID
GetVersionExA
Sleep
CloseHandle
WriteFile
CreateFileW
DeleteFileA
LockResource
LoadResource
LoadLibraryA
FindResourceA
GetTempFileNameA
GetTempPathA
GetModuleFileNameA
ExitProcess
GetLocaleInfoA
HeapSize
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
RtlUnwind

shell32

ShellExecuteExA
SHFileOperationA

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8adcefe74eddb64e0e1d1851b13609e7

Headers

File Characteristics

Imports

advapi32

user32

ole32

oleaut32

ws2_32

kernel32

shell32

Sections

.text Size: 34KB - Virtual size: 34KB

.data Size: 3KB - Virtual size: 8KB

.rsrc Size: 84KB - Virtual size: 83KB

.text
Size: 34KB - Virtual size: 34KB

.data
Size: 3KB - Virtual size: 8KB

.rsrc
Size: 84KB - Virtual size: 83KB