d9ef8ec534ec27c8a7f8fb3ec927423a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d9ef8ec534ec27c8a7f8fb3ec927423a_JaffaCakes118
Size

423KB
MD5

d9ef8ec534ec27c8a7f8fb3ec927423a
SHA1

f656befcde2d9ebf7d931583f0b31326f0ca80ab
SHA256

edb96c1312ea19166a4f9a45a3a47896692d6607c14f8050a9dbedd1e89fe9cf
SHA512

6cf15fccc61e00dbb8d9194bf8caa8ecc32a49f5dd91e5f705aba3683f327ac3652145df1b9030a7fed976d27f499543e4c2ebd7810f33da167efd3e15f31095
SSDEEP

6144:Jjfyq09Gku5mdoiz+qMCsF65ipxToMQIW2HdlFEPlORZTQSNuCFEDlVuSHQH:VTb5md9PipVtWPlcZ9DFEeSHQH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d9ef8ec534ec27c8a7f8fb3ec927423a_JaffaCakes118

Files

d9ef8ec534ec27c8a7f8fb3ec927423a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0741dbd3fcd89c6121fe615c12a667db

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
FoldStringA
GetModuleHandleW
GetTimeZoneInformation
CompareStringA
VirtualQuery
GetCurrentProcess
WideCharToMultiByte
EnumResourceLanguagesA
GetNamedPipeHandleStateA
HeapFree
GetStringTypeW
HeapDestroy
LeaveCriticalSection
HeapReAlloc
GetSystemTimeAsFileTime
MultiByteToWideChar
InterlockedIncrement
GetOEMCP
InterlockedDecrement
GetCurrentProcessId
FreeEnvironmentStringsW
GetCurrentThread
CreateNamedPipeW
TlsAlloc
GetEnvironmentStringsW
GetACP
TlsGetValue
GetLastError
GetModuleFileNameA
TlsSetValue
UnhandledExceptionFilter
GetLocaleInfoA
ExitProcess
LoadLibraryA
GetFileType
DeleteCriticalSection
SetLastError
SetUnhandledExceptionFilter
GetCPInfo
SetConsoleCtrlHandler
FreeLibrary
TerminateProcess
IsValidLocale
TlsFree
InterlockedExchange
GetTickCount
GetStdHandle
RtlUnwind
InitializeCriticalSectionAndSpinCount
LCMapStringW
HeapAlloc
SetEnvironmentVariableA
GetLocaleInfoW
CompareStringW
GetStartupInfoA
GetTimeFormatA
EnumResourceNamesA
Sleep
FreeEnvironmentStringsA
EnterCriticalSection
IsDebuggerPresent
GetModuleHandleA
WriteFile
VirtualAlloc
GetStringTypeA
GetDateFormatA
SetStdHandle
QueryPerformanceCounter
IsValidCodePage
HeapSize
VirtualFree
HeapCreate
EnumSystemLocalesA
GetProcAddress
SetHandleCount
GetCommandLineA
LCMapStringA
GetUserDefaultLCID
GetEnvironmentStrings

wininet

FtpRemoveDirectoryW

gdi32

EndPage
GetEnhMetaFileDescriptionA
GetBkColor
CopyMetaFileW

comdlg32

PrintDlgW
GetSaveFileNameA
PageSetupDlgA
ChooseFontA

Sections

.text
Size: 126KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 279KB - Virtual size: 278KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0741dbd3fcd89c6121fe615c12a667db

Headers

File Characteristics

Imports

kernel32

wininet

gdi32

comdlg32

Sections

.text Size: 126KB - Virtual size: 126KB

.rdata Size: 8KB - Virtual size: 25KB

.data Size: 279KB - Virtual size: 278KB

.rsrc Size: 9KB - Virtual size: 8KB

.text
Size: 126KB - Virtual size: 126KB

.rdata
Size: 8KB - Virtual size: 25KB

.data
Size: 279KB - Virtual size: 278KB

.rsrc
Size: 9KB - Virtual size: 8KB