c0583c7dbbbff104effb6ce14b7018f1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c0583c7dbbbff104effb6ce14b7018f1_JaffaCakes118
Size

80KB
MD5

c0583c7dbbbff104effb6ce14b7018f1
SHA1

356efbb853eda09aee86dbbcc32171d74fed4523
SHA256

15c64b97303959fa91ae3822abdbffb06444898da5d2098b4d066047eb304598
SHA512

3454d0ddd44f40887ffcb638e90cf4976c086499c97ff00c575cc51046c32b82c086965ee8bc120372d100a9192fc3140e954d9b3edc34f6cfa89f0203b093c7
SSDEEP

768:pzQ4OgV6gdNbDAKFZuj1NfhaoJFLJYI3:6tgpdNHdncNfQoJd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0583c7dbbbff104effb6ce14b7018f1_JaffaCakes118

Files

c0583c7dbbbff104effb6ce14b7018f1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

77c2fab967749367720a0fbcb6b87402

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
CreateProcessA
GetExitCodeProcess
WaitForSingleObject
FreeLibrary
CloseHandle
CreateMutexA
Sleep
LoadLibraryA
lstrlenA
GetModuleHandleA
TerminateProcess
GetVersionExA
GetTempPathA
FindFirstFileA
DeleteFileA
FindNextFileA
FindClose
RemoveDirectoryA
GetModuleFileNameA
GetSystemDirectoryA
SetCurrentDirectoryA
GetShortPathNameA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetTickCount
GetProcAddress
OpenProcess
HeapAlloc
MultiByteToWideChar
LCMapStringA
VirtualFree
HeapFree
HeapCreate
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
GetSystemTime
GetCPInfo
GetACP
GetOEMCP
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
GetStringTypeW
RtlUnwind
WriteFile
VirtualAlloc
HeapReAlloc
LCMapStringW
GetStringTypeA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection

user32

DrawTextA
BeginPaint
DestroyWindow
PostThreadMessageA
DefWindowProcA
GetClientRect
EndPaint
PostQuitMessage
CreateWindowExA
ShowWindow
UpdateWindow
LoadIconA
LoadCursorA
RegisterClassExA
ExitWindowsEx
LoadStringA
wsprintfA
PeekMessageA
TranslateMessage
DispatchMessageA
GetForegroundWindow
MessageBoxA

shell32

ShellExecuteA

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

xusulsj
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

77c2fab967749367720a0fbcb6b87402

Headers

File Characteristics

Imports

kernel32

user32

shell32

advapi32

Sections

.text Size: 20KB - Virtual size: 17KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 48KB - Virtual size: 48KB

xusulsj Size: - Virtual size: 4KB

.text
Size: 20KB - Virtual size: 17KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 48KB - Virtual size: 48KB

xusulsj
Size: - Virtual size: 4KB