c1d60d845af8976a04c066dc383c9057_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c1d60d845af8976a04c066dc383c9057_JaffaCakes118
Size

576KB
MD5

c1d60d845af8976a04c066dc383c9057
SHA1

c0abe2389294ed979f523c9a85c1212c76edaa75
SHA256

9f2fb883555f3db5d36b8f1bed15cbf1aaf3f7c9acc3ce490a57a34347b82b75
SHA512

b41054f125840ffd3e3288a0f0605f9bedf12efde7e62635d8aae3c29aea9c082d7c5c94d09a9abc58a0624cb90a08b48864f6065b22a57ddac2a99e4ae84bd8
SSDEEP

12288:DyYWwFvNOb240Z3cacigkosX7G1JDVPQm6xRFXAnGL6IDd35PWBfd0J6ZN38qN:DV9NOB06aNg7FVIPyGGWwwQ5vN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c1d60d845af8976a04c066dc383c9057_JaffaCakes118

Files

c1d60d845af8976a04c066dc383c9057_JaffaCakes118
.exe windows:5 windows x86 arch:x86

2f7f2fdb9e76240f7bf02e9df99d8b93

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegDeleteValueA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteKeyA

user32

SetForegroundWindow
PostQuitMessage
SetWindowPos
IsWindow
DispatchMessageA
GetDC
SendMessageA
DestroyWindow
GetParent
ShowWindow
EnableWindow
PeekMessageA
TranslateMessage
LoadStringA
EnableMenuItem
GetWindowLongA
CreateWindowExA
FillRect
ReleaseDC
SetFocus
SetCapture
KillTimer
DefWindowProcA
GetSystemMetrics
GetWindowRect
PostMessageA
ReleaseCapture
SetWindowLongA
SetWindowTextA
CheckMenuItem
GetSubMenu
LoadCursorA
LoadIconA
GetDesktopWindow
EndDialog
SetDlgItemTextA
MessageBoxA
InvalidateRect
GetClientRect
CallWindowProcA

kernel32

RtlUnwind
VirtualFree
GetEnvironmentVariableA
GetFileType
SetHandleCount
GetStdHandle
GetConsoleOutputCP
WaitForSingleObject
HeapDestroy
FreeEnvironmentStringsA
DeleteCriticalSection
GetCurrentProcess
GetLocaleInfoA
LocalAlloc
FreeEnvironmentStringsW
SetStdHandle
GetCPInfo
GetStringTypeA
WriteFile
HeapReAlloc
GetStringTypeW
SetEvent
InitializeCriticalSection
FindClose
InterlockedDecrement
FormatMessageA
SetLastError
TlsGetValue
VirtualProtect
IsDebuggerPresent
HeapAlloc
FlushFileBuffers
GetModuleFileNameA
GetOEMCP
VirtualAlloc
FindResourceA
Sleep
HeapCreate
CreateProcessA
InterlockedExchange
GetVersion
GetACP
CloseHandle
ReadFile
SetFilePointer
TlsFree
MapViewOfFile
RaiseException
InterlockedCompareExchange
GetCommandLineA
HeapSize
WideCharToMultiByte
GetCommandLineW
GetCurrentProcessId
GetEnvironmentStrings
GlobalUnlock
GetEnvironmentStringsW
LCMapStringA
FindResourceW
GetConsoleCP
GlobalFree
lstrlenA
UnmapViewOfFile
LCMapStringW
GetLastError
InterlockedIncrement
ExitProcess
CreateFileA
TlsSetValue
CreateFileW
GetTimeZoneInformation
GetProcAddress
FindNextFileA
CompareStringA
FindFirstFileA
CompareStringW
GetProcessHeap
GlobalLock
DeleteFileA
CreateDirectoryA
GetStartupInfoA
LoadLibraryA
GetVersionExA
TlsAlloc
IsBadWritePtr
GetTickCount
QueryPerformanceCounter
FreeLibrary
lstrcmpiA
EnterCriticalSection
HeapFree
WriteConsoleW
LeaveCriticalSection
GetCurrentThreadId
GetConsoleMode
VirtualQuery
TerminateProcess
SetUnhandledExceptionFilter
CreateThread
GetModuleHandleA
GetLocalTime
MultiByteToWideChar
UnhandledExceptionFilter

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 521KB - Virtual size: 521KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 672B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2f7f2fdb9e76240f7bf02e9df99d8b93

Headers

File Characteristics

Imports

advapi32

user32

kernel32

Sections

.text Size: 20KB - Virtual size: 20KB

.rdata Size: 521KB - Virtual size: 521KB

.data Size: 32KB - Virtual size: 35KB

.rsrc Size: 1024B - Virtual size: 672B

.text
Size: 20KB - Virtual size: 20KB

.rdata
Size: 521KB - Virtual size: 521KB

.data
Size: 32KB - Virtual size: 35KB

.rsrc
Size: 1024B - Virtual size: 672B