fde9104c502c8030766d38414f16f258_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fde9104c502c8030766d38414f16f258_JaffaCakes118
Size

253KB
MD5

fde9104c502c8030766d38414f16f258
SHA1

00c01dacfb2436247b6eaf1367ed1a3f1b5445f5
SHA256

be4631dc8ac68e890a9f76e28bd90056b68a4288a3aa2a3453af842c3636e643
SHA512

e8ef0252bba776fae59928651b463f227551d9b1f207f61e909264188c008c81b9caa4d8016bcd7c92f173c7ac5cf86ebc707a81ceaf60b941743345d3e73f5f
SSDEEP

6144:92tjN8qg0swN72JnLS1BjieHV4E+7wuTi0ZFStC/Qh:9hqjswAJnLSGK2XwmicEs/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fde9104c502c8030766d38414f16f258_JaffaCakes118

Files

fde9104c502c8030766d38414f16f258_JaffaCakes118
.exe windows:4 windows x86 arch:x86

86d24b322efa105d84ba3bd9f89ddc7f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
GetVersionExA
GetProcessHeap
GetCurrentProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsAlloc
GetLastError
MultiByteToWideChar
ExitProcess
Sleep
GetStartupInfoA
GetModuleFileNameA
GetEnvironmentStringsW
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
InitializeCriticalSection
GetProcAddress

winipsec

GetQMPolicy
DeleteMMPolicy

user32

DestroyIcon
InvalidateRect
ShowWindow
ShowCursor
SendMessageW
EndDialog
SetWindowTextA
RegisterClassExA
TrackPopupMenuEx
RegisterClassW
DefWindowProcA
AppendMenuW
UnregisterClassW
LoadBitmapA
SetMenu
SetFocus
PostMessageA
GetMessageW
RegisterClassA
CreateAcceleratorTableW
CopyRect
LoadIconW
GetCursorPos

gdi32

CreateDIBPatternBrush
StretchDIBits
TranslateCharsetInfo
CreatePalette
RemoveFontResourceA
CreateHatchBrush
CreateCompatibleDC
CreateFontA
CreateFontIndirectW
CreatePen
CreateDIBSection
CreatePolygonRgn
GetTextExtentPointA
CreatePolyPolygonRgn
CreatePatternBrush

avifil32

AVIFileGetStream
AVIFileCreateStream
AVIStreamInfoW
AVIStreamGetFrameOpen
AVISaveVW
EditStreamSetInfoW
IID_IGetFrame
AVIFileOpenA
AVIMakeStreamFromClipboard
AVIPutFileOnClipboard

Sections

.icode
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.iR
Size: 106KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 364KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cUtB
Size: 111KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

86d24b322efa105d84ba3bd9f89ddc7f

Headers

File Characteristics

Imports

kernel32

winipsec

user32

gdi32

avifil32

Sections

.icode Size: 4KB - Virtual size: 3KB

.text Size: 12KB - Virtual size: 16KB

.rdata Size: 2KB - Virtual size: 38KB

.iR Size: 106KB - Virtual size: 165KB

.data Size: 5KB - Virtual size: 364KB

.cUtB Size: 111KB - Virtual size: 169KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 1KB - Virtual size: 4KB

.icode
Size: 4KB - Virtual size: 3KB

.text
Size: 12KB - Virtual size: 16KB

.rdata
Size: 2KB - Virtual size: 38KB

.iR
Size: 106KB - Virtual size: 165KB

.data
Size: 5KB - Virtual size: 364KB

.cUtB
Size: 111KB - Virtual size: 169KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 1KB - Virtual size: 4KB