fe767830e29aac8b67af775952bdaa15_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

fe767830e29aac8b67af775952bdaa15_JaffaCakes118
Size

220KB
MD5

fe767830e29aac8b67af775952bdaa15
SHA1

3b5850a190f498a7bfeb1a8eed6d216772816999
SHA256

8822cca253a0ef958c4950aaf407d5f72bd9b1d047a54007936ac05e2f621408
SHA512

725def1d575cd0d59d54805e2bb0c94c7f1c87b42e1d1e335f38a33ca244ce7311fbd7593506b0da3f208da936282f8480c553ad418eba6c356b836449ee681e
SSDEEP

3072:XZt1/XEo2F0y6me46et7YYOGdRmZgyyt+FR9tpwSQJpAMYNlfaLE7yfNJYUwXVv4:JJU03J4t9DKgHoXnpYLAMYmT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fe767830e29aac8b67af775952bdaa15_JaffaCakes118

Files

fe767830e29aac8b67af775952bdaa15_JaffaCakes118
.exe windows:4 windows x86 arch:x86

34add1a03cb1890f5caedaa3be98c144

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Xezo.pdb

Imports

kernel32

ReadFile
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualProtect
Module32First
CreateToolhelp32Snapshot
WriteConsoleW
TlsAlloc
TlsGetValue
GetTickCount
DeleteFileA
CopyFileA
GetStartupInfoA
CloseHandle
CreateProcessA
Sleep
GetSystemTimeAsFileTime
GetModuleHandleA
GetCommandLineA
GetVersionExA
HeapFree
GetLastError
WriteFile
ExitProcess
GetProcAddress
TerminateProcess
GetCurrentProcess
SetFilePointer
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapAlloc
VirtualAlloc
HeapReAlloc
IsBadWritePtr
SetStdHandle
FlushFileBuffers
CreateFileA
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
RtlUnwind
InterlockedExchange
VirtualQuery
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
HeapSize
SetEndOfFile
GetSystemInfo

user32

SetClipboardData
DestroyWindow
SendMessageA
IsClipboardFormatAvailable
SendDlgItemMessageA
CheckRadioButton
SetForegroundWindow

advapi32

RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
AllocateAndInitializeSid
FreeSid
OpenProcessToken
StartServiceCtrlDispatcherA
InitializeSecurityDescriptor
RegEnumKeyA
RegSetValueExA
RegisterServiceCtrlHandlerA
SetEntriesInAclA
SetSecurityDescriptorDacl
SetServiceStatus
DeleteService
GetTokenInformation
LookupPrivilegeValueA
OpenSCManagerA
OpenServiceA
OpenThreadToken
RegOpenKeyA
RegDeleteKeyA
QueryServiceStatus

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 444KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

34add1a03cb1890f5caedaa3be98c144

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

Sections

.text Size: 80KB - Virtual size: 79KB

.rdata Size: 76KB - Virtual size: 73KB

.data Size: 4KB - Virtual size: 444KB

.rsrc Size: 56KB - Virtual size: 53KB

.text
Size: 80KB - Virtual size: 79KB

.rdata
Size: 76KB - Virtual size: 73KB

.data
Size: 4KB - Virtual size: 444KB

.rsrc
Size: 56KB - Virtual size: 53KB