e08dad6591756e43ed1ca0ca2ec4e2fa_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e08dad6591756e43ed1ca0ca2ec4e2fa_JaffaCakes118
Size

136KB
MD5

e08dad6591756e43ed1ca0ca2ec4e2fa
SHA1

42c3b27b614f7bc947e1683f297e9c0616ce8b70
SHA256

d5f4cec2a5333bcc0df76cde18c22ad8a1d6fa6e92421c70158def4a88e418f0
SHA512

a7a30b4af111e58049879b6b786cac944987bf001023c2a1e38229de42cbabb55626bc234f18f1fe4490167b786234ee53ccc38e6340976b7eb93c3813343825
SSDEEP

3072:TSSeqWZnFEqRgU4YvUr93uJqlec9u0BzF:TSqW5GYcU5+Bz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e08dad6591756e43ed1ca0ca2ec4e2fa_JaffaCakes118

Files

e08dad6591756e43ed1ca0ca2ec4e2fa_JaffaCakes118
.exe windows:4 windows x86 arch:x86

10f9cc6e21015218faf17cc4ec2f2590

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

fermatau

?exists@FilePath@@SA_NPBG_N@Z
?setName@FilePath@@SA?AVCString@WTL@@ABV23@0_N@Z
?deinit@Fermata@@YAXXZ
?init@Fermata@@YAXXZ
?getFolder@SpecialFolder@@SA?AVCString@WTL@@W4FolderID@1@@Z
?makePath@FilePath@@SA?AVCString@WTL@@PBG0_N@Z
?create@FontCache@Fermata@@SAPAV12@XZ

brandingres

?GetInstance@GizeConfig@@SAPAV1@XZ

kernel32

InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
lstrlenA
FreeLibrary
GetThreadLocale
CompareStringA
InterlockedExchange
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
FlushInstructionCache
VirtualQuery
GetVersion
SetLastError

user32

DestroyWindow

advapi32

RegCloseKey

ole32

CoInitialize
CoUninitialize
CoCreateInstance

mslurt

_except_handler3
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_initterm
__wgetmainargs
__dllonexit
_onexit
_controlfp
_adjust_fdiv
_wcmdln
exit
_XcptFilter
_exit
__CxxFrameHandler
??2@YAPAXI@Z
free
_CxxThrowException
wcscpy
_wtoi
_wfullpath
getenv
swprintf
wcslen
vswprintf
memmove
wcstol

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

10f9cc6e21015218faf17cc4ec2f2590

Headers

File Characteristics

Imports

fermatau

brandingres

kernel32

user32

advapi32

ole32

mslurt

Sections

.text Size: 88KB - Virtual size: 87KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 8KB - Virtual size: 6KB

.rsrc Size: 28KB - Virtual size: 28KB

.text
Size: 88KB - Virtual size: 87KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 8KB - Virtual size: 6KB

.rsrc
Size: 28KB - Virtual size: 28KB