b889c1e75e6adb6f94ca4ca15ad82865_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b889c1e75e6adb6f94ca4ca15ad82865_JaffaCakes118
Size

333KB
MD5

b889c1e75e6adb6f94ca4ca15ad82865
SHA1

0c54ee2f9b104766a9d9dc169dd33798b5c9ede0
SHA256

3c4abe8fb5ada8e91e975459811e4af6f8e21f3e66f3ce18284c79e858d8e1b6
SHA512

2448ff01a8f9424d8d9c317936ec3099f502b824797bf005b4e11d8e65e823287fd543ffd65c0fc34b5340d0e09cb50c10d3fb4536c8bc1a83435a472d02068d
SSDEEP

6144:GnCGyOijQpcE3TT9y8ucV+eadHAGRSr5Rkw7ePISOs656Js7A2:GhOkpBHuccIdKw7ePbOsdJs7A2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b889c1e75e6adb6f94ca4ca15ad82865_JaffaCakes118

Files

b889c1e75e6adb6f94ca4ca15ad82865_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3cfc909fd686d8f0a5dcc27234772190

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedIncrement
InterlockedCompareExchange
UnhandledExceptionFilter
WideCharToMultiByte
GetComputerNameW
InterlockedDecrement
MultiByteToWideChar
LocalFree
LocalAlloc
GetLastError
lstrlenW
CompareFileTime
GetOverlappedResult
ReadFile
CreateEventW
GetSystemTimes
CreateDirectoryW
CloseHandle
GetModuleHandleW
GetVolumeInformationW
LoadLibraryW
ExpandEnvironmentStringsW
MoveFileExW
SetFileTime
CreateFileW
DeleteTimerQueueTimer
FindNextFileW
FindClose
FindFirstFileW
CreateTimerQueueTimer
DeleteCriticalSection
DeleteFileW
RtlUnwind
DisableThreadLibraryCalls
GetModuleHandleA
GetProcAddress
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
VirtualAlloc
QueryPerformanceCounter
LeaveCriticalSection
Sleep
InterlockedExchange
EnterCriticalSection
GetProcessHeap
HeapAlloc
GetCommandLineA
VirtualProtect
VirtualFree
GetFileAttributesExW
GetStartupInfoA

user32

SetCursor

advapi32

IsValidSid
RegDeleteKeyW
SetSecurityDescriptorDacl
SetEntriesInAclW
GetTokenInformation
OpenProcessToken
CreateWellKnownSid
InitializeSecurityDescriptor
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
TraceMessage
RegisterTraceGuidsW
RegCloseKey

ole32

CoGetClassObject
CoCreateInstance
CoTaskMemFree
StringFromCLSID
CoGetObject
StringFromGUID2
CoSetProxyBlanket
CoQueryProxyBlanket

msvcr71

_controlfp
_onexit
__dllonexit
__set_app_type
__p__fmode
__p__commode
__setusermatherr
__getmainargs
_except_handler3
free
_vsnwprintf
_XcptFilter
memset
malloc
realloc
qsort
bsearch
strchr
memmove
_itow
strstr
strncmp
wcschr
memcpy
_wcsicmp
wcsrchr
atof
_stricmp
isalnum
_adjust_fdiv
_amsg_exit
_callnewh
_initterm
_c_exit
_exit
_ismbblead
_cexit
exit
_acmdln

Sections

.text
Size: 325KB - Virtual size: 325KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 277KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3cfc909fd686d8f0a5dcc27234772190

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

msvcr71

Sections

.text Size: 325KB - Virtual size: 325KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 277KB

.sxdata Size: 512B - Virtual size: 8B

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 325KB - Virtual size: 325KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 277KB

.sxdata
Size: 512B - Virtual size: 8B

.rsrc
Size: 1KB - Virtual size: 1KB