c95d2fdac960cac3001107915e5aaa03_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c95d2fdac960cac3001107915e5aaa03_JaffaCakes118
Size

2.1MB
MD5

c95d2fdac960cac3001107915e5aaa03
SHA1

5a73c7854154bee72befa7fc105dac2a0a9ea612
SHA256

4b2c1fc2d0bc7718bd7721a2b7b619fedce03806e58d4676b453c30fc97c0409
SHA512

7d9140156e84d5c8fe6b5890dbb5342f6f508a325ad5600fca2348cbb7d02cee10581df7d7a2e78857e9cac9f6eb10f901a5b83ddbc1bdeb044f72e2ef437af4
SSDEEP

49152:QriWY/bvhWbl9O99DnKc1XYCAsWYus7D98khU+:QmWKDsh099DKc1nAsWjsekhU+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c95d2fdac960cac3001107915e5aaa03_JaffaCakes118

Files

c95d2fdac960cac3001107915e5aaa03_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2032d01819c6cc38d95efd234fa66b80

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualLock
VirtualFree
GetVersion
GetAtomNameA
GetThreadPriority
GetShortPathNameA
ConnectNamedPipe
SetConsoleMode
UnmapViewOfFile
GetWindowsDirectoryA
CreateFileW
SetConsoleCursorPosition
GetPrivateProfileStringW
QueryDosDeviceW
GetShortPathNameW
ReadConsoleInputW
GetNumberFormatW
_hread
GetCommConfig
GetTapeParameters
GetEnvironmentStringsW
GetPrivateProfileStringA
GetFileAttributesExA
InitializeCriticalSection
GlobalFlags
GetModuleHandleA
ExitProcess
GetConsoleCursorInfo

advapi32

LookupAccountSidW
SetSecurityDescriptorGroup
EqualSid
CryptGetProvParam
ObjectCloseAuditAlarmA
GetSecurityDescriptorGroup
RegOpenKeyA
GetSecurityDescriptorLength
QueryServiceStatus
GetNamedSecurityInfoA
SetFileSecurityW
SetSecurityDescriptorSacl
BuildSecurityDescriptorW
OpenServiceA
AdjustTokenPrivileges
RegGetKeySecurity

user32

InvalidateRect
GetDC
wvsprintfW
CreateWindowStationW
EnableWindow
OpenDesktopA
GetLastActivePopup
RegisterDeviceNotificationA
GetParent
OpenWindowStationA
RegisterClassExW
GetThreadDesktop
GetMonitorInfoA
GetCursorPos
GetCaretBlinkTime
IsCharLowerA
TileWindows
AppendMenuW
GetWindowTextLengthW
LoadStringW
UnregisterClassA
WaitMessage
SetTimer
LoadCursorA
ShowOwnedPopups
CharUpperA
SetPropW

ws2_32

WSASetLastError
WSAAsyncGetProtoByNumber
gethostname
WSASendTo
WSACancelAsyncRequest
WSAAsyncSelect
WSASocketW
WSASetBlockingHook
WSARecvDisconnect

shell32

DragQueryPoint
SHGetSettings

gdi32

GetSystemPaletteUse
CreateBitmap
ExtEscape
ArcTo

ole32

CoCreateInstanceEx
OleCreateFromData

version

VerFindFileA

msvcrt

wcsftime
_stricoll
clock
signal
iswspace
iswctype
_access
_wchmod
vprintf
_mbsnextc
wscanf
putc
_putenv
_sys_errlist
_sopen
_stat
_chsize
iswprint
free
_execlp
fprintf
_mbctolower
fgets
_itoa
_strtime

Sections

.text
Size: 10KB - Virtual size: 227KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 512B - Virtual size: 6B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2032d01819c6cc38d95efd234fa66b80

Headers

File Characteristics

Imports

kernel32

advapi32

user32

ws2_32

shell32

gdi32

ole32

version

msvcrt

Sections

.text Size: 10KB - Virtual size: 227KB

.text Size: 512B - Virtual size: 6B

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 1.8MB - Virtual size: 1.8MB

.rsrc Size: 17KB - Virtual size: 16KB

.text
Size: 10KB - Virtual size: 227KB

.text
Size: 512B - Virtual size: 6B

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 1.8MB - Virtual size: 1.8MB

.rsrc
Size: 17KB - Virtual size: 16KB