c0b81a389cad9254ee73546ffd65738f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c0b81a389cad9254ee73546ffd65738f_JaffaCakes118
Size

880KB
MD5

c0b81a389cad9254ee73546ffd65738f
SHA1

9cb474961731a94aac0327d74b3d1384803fcac5
SHA256

19b0be207b53133887726dc95646b3937cd9a5fa483447c25d7b50f66c24ad87
SHA512

7432c34afc93ecd7c6f9d3160bf7996f40893813343f5a3456b949a86ef09b85761ccf780587acf2255c80d46edf75c8e0e4abe1db8c2bc5cd69bf1466f7fd67
SSDEEP

24576:tfKRxNISe3qfJq7KTY0eKKrOR47WoygjqQAZfZgaY:tfKn+xekr247WoygjqpQP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0b81a389cad9254ee73546ffd65738f_JaffaCakes118

Files

c0b81a389cad9254ee73546ffd65738f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6e2e6a3b3d848a7e4ac8b60056cb76de

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

LoadTypeLibEx
QueryPathOfRegTypeLi
VariantCopy
SafeArrayPutElement
VariantChangeType
SysAllocStringLen

user32

SetCaretBlinkTime
UnloadKeyboardLayout
GetUpdateRgn
LoadImageA
GetMonitorInfoW
SetWindowsHookExW
CharUpperW
GetWindowPlacement
CharUpperBuffW
BroadcastSystemMessageW
LoadKeyboardLayoutA
GetClientRect
GrayStringW
MenuItemFromPoint
OpenInputDesktop

advapi32

LookupPrivilegeValueA
RegSetValueW
RegEnumKeyExA
SetSecurityDescriptorSacl
GetSecurityDescriptorLength

ole32

CoLockObjectExternal
CoCreateInstanceEx

version

GetFileVersionInfoA

kernel32

GetHandleInformation
WriteConsoleOutputCharacterA
PrepareTape
DuplicateHandle
IsBadReadPtr
SetNamedPipeHandleState
EraseTape
GetShortPathNameW
ExitThread
ConnectNamedPipe
CreatePipe
LocalAlloc
EnumCalendarInfoA
MoveFileExA
RemoveDirectoryA
ReleaseMutex
PurgeComm
CreateDirectoryW
GetShortPathNameA
GlobalReAlloc
SetThreadAffinityMask
GetWindowsDirectoryA
_lread
GetTempPathW
SetVolumeLabelA
FindFirstFileA
SetFileAttributesA
ExitProcess
SetLastError
OpenMutexA
GetNumberFormatW
GetCommModemStatus
FindNextChangeNotification
lstrcpyA
SetFileTime
GetUserDefaultLCID
GetSystemDefaultLangID
SetThreadLocale
ReadFile
GlobalAddAtomA

msvcrt

localtime
_eof
fread
_wtoi
_wfsopen
_beginthread
_mbsnbcnt
fseek
wcstoul
_fsopen
wcscoll
fscanf
wcscat
strerror
perror
_strcmpi
_sleep
wcsncat
_i64tow
wcsncpy
_wmakepath
wctomb
vprintf
fwscanf
_mbsnbcat

Sections

.text
Size: 2KB - Virtual size: 218KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 612KB - Virtual size: 612KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6e2e6a3b3d848a7e4ac8b60056cb76de

Headers

File Characteristics

Imports

oleaut32

user32

advapi32

ole32

version

kernel32

msvcrt

Sections

.text Size: 2KB - Virtual size: 218KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 612KB - Virtual size: 612KB

.rsrc Size: 17KB - Virtual size: 16KB

.text
Size: 2KB - Virtual size: 218KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 612KB - Virtual size: 612KB

.rsrc
Size: 17KB - Virtual size: 16KB