bfa791f3221cdc591e79622e09e8a1fa_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

bfa791f3221cdc591e79622e09e8a1fa_JaffaCakes118
Size

81KB
MD5

bfa791f3221cdc591e79622e09e8a1fa
SHA1

1579cc72ef67f109dd003e0a82bc011452ebe5d3
SHA256

db18264d4df56a3742bb055c28683dba3d0d383531dd92dcd3b3b054e8f1a4aa
SHA512

547618fc2c343c95bedf25ea22bbad9774bda3cb795080f85f5738287aefb59a5d3a9b1efaa503fd01b725e213c47480eaeeb21df499199161ab0b9d7d6411ac
SSDEEP

1536:osi2qlXCVWewU19A3XU1JyCZ7nFd7UkfzeHaqv7K1GMGvryb7:2rXCYe9cARUkfzQPyv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bfa791f3221cdc591e79622e09e8a1fa_JaffaCakes118

Files

bfa791f3221cdc591e79622e09e8a1fa_JaffaCakes118
.exe windows:1 windows x86 arch:x86

f4eb7eb36e9290350d839ce77a1bad6a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

advapi32

RegCloseKey
RegDeleteValueA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA

kernel32

CloseHandle
CreateFileA
CreateFileW
CreateProcessA
DeleteFileA
DeleteFileW
EnterCriticalSection
ExitProcess
FileTimeToDosDateTime
FileTimeToLocalFileTime
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatA
GetEnvironmentStrings
GetFileAttributesA
GetFileAttributesW
GetFileTime
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileIntA
GetProcAddress
GetStartupInfoA
GetStdHandle
GetStringTypeW
GetSystemDirectoryA
GetSystemTime
GetTempFileNameA
GetTimeZoneInformation
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LocalAlloc
LocalFree
MoveFileA
MultiByteToWideChar
RaiseException
ReadFile
RtlUnwind
SetConsoleCtrlHandler
SetCurrentDirectoryA
SetFilePointer
SetHandleCount
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnlockFile
VirtualAlloc
VirtualFree
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
WritePrivateProfileStringA
lstrcatA
lstrcpyA
lstrlenA

wsock32

WSACleanup
WSAStartup
closesocket
connect
gethostbyname
gethostname
htons
inet_addr
inet_ntoa
recv
send
socket

user32

EnumThreadWindows
FindWindowA
IsCharAlphaA
MessageBoxA

Exports

Exports

@__lockDebuggerData$qv
@__unlockDebuggerData$qv
__DebuggerHookData
__GetExceptDLLinfo
___CPPdebugHook

Sections

.text
Size: 60KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f4eb7eb36e9290350d839ce77a1bad6a

Headers

File Characteristics

Imports

advapi32

kernel32

wsock32

user32

Exports

Exports

Sections

.text Size: 60KB - Virtual size: 64KB

.data Size: 11KB - Virtual size: 212KB

.tls Size: 512B - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.idata Size: 2KB - Virtual size: 4KB

.edata Size: 512B - Virtual size: 4KB

.reloc Size: 3KB - Virtual size: 4KB

.text
Size: 60KB - Virtual size: 64KB

.data
Size: 11KB - Virtual size: 212KB

.tls
Size: 512B - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.idata
Size: 2KB - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 4KB

.reloc
Size: 3KB - Virtual size: 4KB