fd30be0f07811d3c7caea8323c9bc887_JaffaCakes118

General

Target

fd30be0f07811d3c7caea8323c9bc887_JaffaCakes118
Size

40KB
MD5

fd30be0f07811d3c7caea8323c9bc887
SHA1

188e4c5979994ebeb3c4409b42eb1e6e7b4a5283
SHA256

e33a8f1ed3a3372914f2546bd1304558627402f79509d1108815069d8c7446fb
SHA512

43055e78b6192516c5db8e8c949a4f473c1482328937e267b672ebe3791f10a1205447723b9ccdfbaaaa668383a2bb48e5f113f18e18e4566ac8a0d43f10cb0e
SSDEEP

768:pHNpMktS+hrO07gwCd1vnwn74WaxugBqlmR2:pHNpMktSCh7gwS1vnOoHqly2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fd30be0f07811d3c7caea8323c9bc887_JaffaCakes118

Files

fd30be0f07811d3c7caea8323c9bc887_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a7df1250efa97eb496f7f456aeb58add

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
FindClose
FindFirstFileA
FindNextFileA
FormatMessageA
SetCurrentDirectoryA
MoveFileExA
OpenProcess
Process32Next
Process32First
GetCurrentProcessId
CreateToolhelp32Snapshot
DeleteFileA
GetLocalTime
GetWindowsDirectoryA
WriteFile
lstrcpyA
GetSystemDirectoryA
lstrcmpA
GetCommandLineA
GetVersionExA
GetCurrentProcess
WideCharToMultiByte
MultiByteToWideChar
ReadFile
SetFilePointer
GetFileSize
GetTickCount
GetCurrentThreadId
QueryPerformanceCounter
LCMapStringW
SetFileTime
CloseHandle
lstrlenA
GlobalAlloc
CreateProcessA
lstrcpynA
GlobalFree
GetSystemTimeAsFileTime
LCMapStringA
GetSystemInfo
VirtualProtect
GetLocaleInfoA
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetStartupInfoA
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
HeapReAlloc
HeapAlloc
HeapSize
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
GetCPInfo
LoadLibraryA
VirtualAlloc
RtlUnwind
InterlockedExchange
VirtualQuery

user32

MessageBoxA
wsprintfA

advapi32

GetTokenInformation
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
OpenProcessToken

shell32

ShellExecuteExA

psapi

EnumProcessModules
GetModuleFileNameExA

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a7df1250efa97eb496f7f456aeb58add

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

psapi

Sections

.text Size: 24KB - Virtual size: 21KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 3KB

.text
Size: 24KB - Virtual size: 21KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 3KB