e09d4411f612ac8eda11a159315a2ee7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e09d4411f612ac8eda11a159315a2ee7_JaffaCakes118
Size

52KB
MD5

e09d4411f612ac8eda11a159315a2ee7
SHA1

b969bdf9333142f76c8eb16d67925edde6acaf19
SHA256

a66dfae88417da2e4cc057483a00369ed5ab7d6d1f94a029ae6c715f9748ba23
SHA512

77a0d9fd0857cd438d18ec9c9b8d606eb34382a9352f7cda609b97229dc4e0e4f7554b307f857c889ab4925afb3ade1bd07ac407bc6f791e767e230c68cdc580
SSDEEP

768:A/8DSDXP0XxI7Q2OBF0Rn4l7kV7E+wVCsZvxbQnZ1qN:A/9rPvOB+R4l7CfKoZ1+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e09d4411f612ac8eda11a159315a2ee7_JaffaCakes118

Files

e09d4411f612ac8eda11a159315a2ee7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

699b0ffc61b6e8fa78f9473c5b0e558a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\DebugBmw1.0\BMW\release\Loader91.pdb

Imports

kernel32

LoadResource
GlobalAlloc
LockResource
CreateFileW
CloseHandle
SetFilePointer
WriteFile
GlobalFree
GetSystemDirectoryW
GetShortPathNameW
GetStartupInfoW
SizeofResource
WaitForSingleObject
TerminateProcess
GetModuleFileNameW
SetPriorityClass
GetCurrentProcess
SetThreadPriority
GetCurrentThread
SetProcessPriorityBoost
MultiByteToWideChar
FindResourceExW
FindResourceW
DeleteFileW
CreateProcessW
CreateDirectoryW
Sleep
DeleteCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetVersionExA
GetThreadLocale
InterlockedCompareExchange
GetLocaleInfoA
GetACP
InterlockedExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

shell32

ShellExecuteW
ShellExecuteExW
SHChangeNotify

ole32

CoUninitialize
CoCreateInstance
CoInitialize

shlwapi

PathFileExistsW

msvcr80

_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
free
memmove_s
memcpy_s
wcsncpy_s
wcscat_s
??3@YAXPAX@Z
_CxxThrowException
__CxxFrameHandler3
memset
memcpy

user32

UnregisterClassA

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

699b0ffc61b6e8fa78f9473c5b0e558a

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shell32

ole32

shlwapi

msvcr80

user32

Sections

.text Size: 12KB - Virtual size: 9KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 4KB - Virtual size: 97KB

.rsrc Size: 24KB - Virtual size: 22KB

.text
Size: 12KB - Virtual size: 9KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 4KB - Virtual size: 97KB

.rsrc
Size: 24KB - Virtual size: 22KB