ceb18198db7cfb9a5cee717205fd33cf_JaffaCakes118

General

Target

ceb18198db7cfb9a5cee717205fd33cf_JaffaCakes118
Size

88KB
MD5

ceb18198db7cfb9a5cee717205fd33cf
SHA1

024d61367427f556f89767de2a04f7851686f0b2
SHA256

581716e2181d5f5b5f50393f4e1c12ad17b8756edadf80e2e02d02f657ac8088
SHA512

131012763096c4ae63aff95c79dee0f493b40e1ba029db4bd43e95da20dcf51986be131b278788b2164e6eeea3ec51663300bc9f9c48c4f236d4dfa2973c6943
SSDEEP

1536:vgFn8xKo728Ea2tmd9rq5KHtoPdq/ub0:vgFn8R7HlrqkHtoPdqGg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ceb18198db7cfb9a5cee717205fd33cf_JaffaCakes118

Files

ceb18198db7cfb9a5cee717205fd33cf_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5640ebddc6fb3d252f89c7ec15fae66b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RemoveDirectoryA
CloseHandle
GetExitCodeProcess
WaitForSingleObject
Sleep
CopyFileA
GetVersion
GetTempFileNameA
GetTempPathA
RaiseException
LCMapStringW
LCMapStringA
FormatMessageA
GetModuleFileNameA
GetEnvironmentVariableA
GetShortPathNameA
CreateProcessA
GetCurrentProcess
SetPriorityClass
SetFileAttributesA
ResumeThread
DeleteFileA
GetLastError
SetStdHandle
LoadLibraryA
GetOEMCP
GetACP
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
ExitProcess
HeapFree
HeapAlloc
GetProcAddress
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
SetFilePointer
VirtualAlloc
HeapReAlloc
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetCPInfo
FlushFileBuffers

user32

MessageBoxA
LoadStringA

advapi32

RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA

shell32

SHGetPathFromIDListA
SHChangeNotify
SHGetSpecialFolderLocation

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5640ebddc6fb3d252f89c7ec15fae66b

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

Sections

.text Size: 44KB - Virtual size: 44KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 16KB - Virtual size: 18KB

.rsrc Size: 16KB - Virtual size: 36KB

.text
Size: 44KB - Virtual size: 44KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 16KB - Virtual size: 18KB

.rsrc
Size: 16KB - Virtual size: 36KB