d1078cc996960b8d1ce16e8795eb1789_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

d1078cc996960b8d1ce16e8795eb1789_JaffaCakes118
Size

75KB
MD5

d1078cc996960b8d1ce16e8795eb1789
SHA1

2417cf91908a2d4ef13400bd3cb335e755c06314
SHA256

da409cc7112110bd4ee80dc96e599b001119938b7d7bdaefddecbe7470969ed7
SHA512

fb85db9427d3617c35d064bc7ed4bad3db15a27678b4b9dad1e9cd434d693e1be862b2f2abe1919a18f36e93ea8fedcc287daea9f5f6a922184a481ae451d09d
SSDEEP

768:yZ8vKqOrKEFVXXenVNhF123w7p3kF5lPE1GHUTcze2hVPUXRErSQO1InJ7tr:LvKqOrKEFx4XhF12A/O3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d1078cc996960b8d1ce16e8795eb1789_JaffaCakes118

Files

d1078cc996960b8d1ce16e8795eb1789_JaffaCakes118
.exe windows:1 windows x86 arch:x86

f2435243a14a0cf97e3d107563818f79

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

Sleep
GetVersion
GetTempPathA
GetSystemDirectoryA
GetLogicalDrives
GetLocalTime
GetCommandLineA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
ExitThread
DeleteFileA
CreateThread
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
GetModuleFileNameA
GetCurrentThreadId
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
lstrcpyA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

oleaut32

VariantChangeTypeEx
VariantCopyInd
VariantClear
SysStringLen
SysFreeString
SysAllocStringLen

shell32

ShellExecuteA

user32

GetKeyboardType
LoadStringA
MessageBoxA
CharNextA

Sections

.unp_01
Size: 64KB - Virtual size: 80KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.unp_02
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.unp_03
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idat_01
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.relo_01
Size: 3KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f2435243a14a0cf97e3d107563818f79

Headers

File Characteristics

Imports

kernel32

advapi32

oleaut32

shell32

user32

Sections

.unp_01 Size: 64KB - Virtual size: 80KB

.unp_02 Size: 4KB - Virtual size: 4KB

.unp_03 Size: 512B - Virtual size: 4KB

.idat_01 Size: 2KB - Virtual size: 4KB

.relo_01 Size: 3KB - Virtual size: 32KB

.unp_01
Size: 64KB - Virtual size: 80KB

.unp_02
Size: 4KB - Virtual size: 4KB

.unp_03
Size: 512B - Virtual size: 4KB

.idat_01
Size: 2KB - Virtual size: 4KB

.relo_01
Size: 3KB - Virtual size: 32KB