b6532a98dacae7b8aa49e767c954e794_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b6532a98dacae7b8aa49e767c954e794_JaffaCakes118
Size

188KB
MD5

b6532a98dacae7b8aa49e767c954e794
SHA1

99fad733cb57e19aa559d2c09b9e95b1122b527a
SHA256

8fe458bac909a0c31b3ed292ad1f0311b06cb9ee126c36d6d31a4488473f23bf
SHA512

b3f3593e8d90dc83e16e1d8e79ce9bf6ab7f40844984146a2bb0caa48b2b3175d9ace95a131eb1d5ad02db0e4f6481d088944d3e52b4e4a33a6fe80ccee7982f
SSDEEP

3072:bGJ8H1Woxj3aCnyOJqVzjz3cGmRfw/xe7/I62bXZP65UfSo4yJaVL3nXkfDv:bxh3aCnytVzXM/p7WpCGSdyEhXq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b6532a98dacae7b8aa49e767c954e794_JaffaCakes118

Files

b6532a98dacae7b8aa49e767c954e794_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7c24a37bf3dc364542d5638355fa0db0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfA
CharNextA

kernel32

LoadLibraryA
HeapFree
GetProcAddress
GetModuleHandleA
HeapAlloc
GetProcessHeap
GetLastError
lstrcatA
ExitProcess
CreateDirectoryA
lstrlenA
SetEnvironmentVariableA
lstrcpyA
GetWindowsDirectoryA
GetTempPathA
MoveFileA
CloseHandle
SetFileTime
GetFileTime
SetFilePointer
WriteFile
CreateFileA
FindNextFileA
FindFirstFileA
GetTickCount
GetSystemDirectoryA
lstrcmpiA
GetModuleFileNameA
Sleep
WaitForSingleObject
CreateEventA
GetFileAttributesA
GetShortPathNameA
ExpandEnvironmentStringsA
OpenEventA
SetUnhandledExceptionFilter
GetCommandLineA
WideCharToMultiByte
MultiByteToWideChar
DeleteFileA
SetFileAttributesA
Process32Next
GetCurrentProcessId
Process32First
CreateToolhelp32Snapshot
FreeLibrary
LocalAlloc
InterlockedExchange
RaiseException
GetStartupInfoA

sfc

SfcIsFileProtected

shlwapi

SHDeleteKeyA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA

msvcrt

_itoa
_strnicmp
_stricmp
_strlwr
_controlfp
__set_app_type
_except_handler3
strcat
strncat
strchr
strcpy
memset
strlen
rand
srand
_ftol
??2@YAPAXI@Z
memcpy
??3@YAXPAX@Z
strcmp
__CxxFrameHandler
_CxxThrowException
strncpy
strstr
free
malloc
toupper
tolower
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode

netapi32

NetApiBufferFree
NetUserGetLocalGroups

Sections

.text
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 160KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7c24a37bf3dc364542d5638355fa0db0

Headers

File Characteristics

Imports

user32

kernel32

sfc

shlwapi

version

msvcrt

netapi32

Sections

.text Size: 16KB - Virtual size: 13KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 160KB - Virtual size: 162KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 16KB - Virtual size: 13KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 160KB - Virtual size: 162KB

.rsrc
Size: 4KB - Virtual size: 1KB