b9974a72f40e81998979dd010d046ca3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b9974a72f40e81998979dd010d046ca3_JaffaCakes118
Size

128KB
MD5

b9974a72f40e81998979dd010d046ca3
SHA1

82f34057deec5ca361bd6faa0b624095105eb290
SHA256

6d85a0f785549406161f23355eb80c32f8ec4641562e267c211ab1e8637a4a62
SHA512

7c309c5ee0e0dbf10dd8cc540e4f18fbd1fca4737ea346eae18c9002eead052e3aa7ffe73a973cd6193620afbe6aa55289963043a09e4bbae4c1ab8038bf10ce
SSDEEP

1536:aALseYrtC9TkI0trOjSXUTBdyDQlBrEmHXZY1yKeyZ4qjjAFll8G:3A/eTsrNSBrbCQKe2jjAFllZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b9974a72f40e81998979dd010d046ca3_JaffaCakes118

Files

b9974a72f40e81998979dd010d046ca3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f17e727229b1989e9381d8db4756654d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHDeleteKeyA

wininet

InternetCloseHandle
InternetReadFile
InternetOpenA
InternetOpenUrlA

rpcrt4

RpcStringFreeA
UuidToStringA
UuidCreate

kernel32

GetSystemDirectoryA
Sleep
GetLastError
GetTempFileNameA
GetTempPathA
SetEvent
GetCurrentProcessId
CloseHandle
WaitForSingleObject
CreateEventA
WriteProcessMemory
GetProcAddress
GetVolumeInformationA
CreateProcessA
lstrcpynA
GetCommandLineA
lstrcmpA
GetShortPathNameA
GetModuleFileNameA
lstrlenA
GetVersionExA
GetTickCount
QueryPerformanceCounter
SetEndOfFile
ReadFile
ResumeThread
GetPriorityClass
OpenProcess
GetModuleHandleA
TlsGetValue
RtlUnwind
ExitProcess
TerminateProcess
GetCurrentProcess
GetSystemTimeAsFileTime
DeleteFileA
RaiseException
GetStartupInfoA
HeapAlloc
TlsAlloc
SetLastError
GetCurrentThreadId
TlsFree
TlsSetValue
CreateRemoteThread
HeapFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
WriteFile
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
HeapReAlloc
HeapSize
SetUnhandledExceptionFilter
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetFilePointer
GetACP
GetOEMCP
GetCPInfo
IsBadReadPtr
IsBadCodePtr
InitializeCriticalSection
InterlockedExchange
VirtualQuery
SetStdHandle
FlushFileBuffers
CreateFileA
GetLocaleInfoA
VirtualProtect
GetSystemInfo
GetStringTypeA
GetStringTypeW
LoadLibraryA

user32

CharLowerA
wsprintfA

advapi32

RegDeleteValueA
RegOpenKeyExA
RegEnumValueA
RegQueryValueExA
RegSetValueExA
RegOpenKeyA
RegQueryValueA
RegCreateKeyExA
RegCloseKey
RegDeleteKeyA
RegEnumKeyA

Sections

.text
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f17e727229b1989e9381d8db4756654d

Headers

File Characteristics

Imports

shlwapi

wininet

rpcrt4

kernel32

user32

advapi32

Sections

.text Size: 76KB - Virtual size: 76KB

.rdata Size: 16KB - Virtual size: 16KB

.data Size: 16KB - Virtual size: 16KB

.reloc Size: 16KB - Virtual size: 16KB

.text
Size: 76KB - Virtual size: 76KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 16KB - Virtual size: 16KB

.reloc
Size: 16KB - Virtual size: 16KB