f05ea2660f1be77bdcc61389cdbad567_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

f05ea2660f1be77bdcc61389cdbad567_JaffaCakes118
Size

808KB
MD5

f05ea2660f1be77bdcc61389cdbad567
SHA1

506242ba7b9581d1dcf431fa738d1ffb5b05d573
SHA256

82c2ec1ec6fc9194933f4536e6cb8ec561ad36d90ae43eb5ae0e55d6b20e6161
SHA512

1b925885c2aaa5fd728acff66c5189646c69a4000a0e6357332f9b55f1c44a7a03125e2099c9c7da78eae19a1220020287a10df1490caeb45379191bbb4034b9
SSDEEP

24576:4VrVqVZb952i8EoXjxRsMT51gMGrm5oA9:Pr6iPm1RsS51gMrV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f05ea2660f1be77bdcc61389cdbad567_JaffaCakes118

Files

f05ea2660f1be77bdcc61389cdbad567_JaffaCakes118
.exe windows:5 windows x86 arch:x86

edda31a669665ef535e5ebb759e73d6b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalAlloc
VirtualAlloc
GetCurrentProcess
GetEnvironmentStringsW
GetCurrentThreadId
GetLastError
InitializeCriticalSectionAndSpinCount
SetFilePointer
CloseHandle
ClearCommError
GetCommMask
FileTimeToSystemTime
lstrcmpiW
TlsGetValue
TlsSetValue
TlsFree
CreateEventW
CreateFileMappingW
LoadLibraryExW
GetModuleFileNameW
GetCommandLineW
CreateFileW
GetFileAttributesW
DeleteFileW
IsValidCodePage
MultiByteToWideChar
CompareStringW
GetLocaleInfoW
EnumLanguageGroupLocalesW
GetConsoleWindow
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
LoadLibraryA
GetProcAddress
HeapReAlloc
HeapAlloc
GetOEMCP
GetACP
GetCPInfo
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
WriteFile
RtlUnwind
HeapFree
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
SetLastError
TlsAlloc
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
UnhandledExceptionFilter
GetModuleFileNameA

user32

DdeClientTransaction
FreeDDElParam
CreateIconFromResource
CreateIcon
RedrawWindow
GetWindowRgn
GetFocus

shlwapi

SHAutoComplete
SHGetValueW
SHDeleteEmptyKeyW
UrlUnescapeW
PathStripPathW
PathRemoveBlanksW
PathRemoveBackslashW
PathIsNetworkPathW
PathIsUNCW
PathIsRootW
PathGetDriveNumberW
PathFindNextComponentW
PathFindFileNameW
PathFileExistsW
PathCanonicalizeW
SHStrDupW
StrRetToStrW
StrToIntExW
StrRChrW
StrPBrkW
StrFormatByteSizeW
StrCmpNW
StrChrW
PathIsDirectoryW

oleaut32

CreateErrorInfo
RegisterTypeLi
VarBoolFromStr
VarBstrFromBool
VarI4FromStr
VariantChangeTypeEx
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayGetUBound
SysReAllocStringLen
SysAllocStringLen

Sections

.text
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 6.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.85enry
Size: 731KB - Virtual size: 731KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

edda31a669665ef535e5ebb759e73d6b

Headers

File Characteristics

Imports

kernel32

user32

shlwapi

oleaut32

Sections

.text Size: 41KB - Virtual size: 41KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 11KB - Virtual size: 6.4MB

.85enry Size: 731KB - Virtual size: 731KB

.rsrc Size: 19KB - Virtual size: 22KB

.text
Size: 41KB - Virtual size: 41KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 11KB - Virtual size: 6.4MB

.85enry
Size: 731KB - Virtual size: 731KB

.rsrc
Size: 19KB - Virtual size: 22KB