feb47a783236ea6651a8568133af2b32_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

feb47a783236ea6651a8568133af2b32_JaffaCakes118
Size

632KB
MD5

feb47a783236ea6651a8568133af2b32
SHA1

30b494d20a02c5581a07f12c7380778f12d4e184
SHA256

ce82c5acd4a3b7a1d54d41c65867a1b35f535b789f39e4d1cf47739976deeac3
SHA512

024631a9e510b4e4ce7566a71e6f969719d8b413f874c039bca0f096c52c50cd5d6d006cb07ab9214d2080d26a6fd47c15a21ec9e9a3b3f5fa606aee183f2516
SSDEEP

12288:cb+J9Ci2XJG7naTVG4VtKl1n3amDrHvtjbkrXiBhwLCt:++F287naTVG4nKf7vJArXi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
feb47a783236ea6651a8568133af2b32_JaffaCakes118

Files

feb47a783236ea6651a8568133af2b32_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e93bb4ec98cbd0db060d70b649aefc44

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

userenv

LeaveCriticalPolicySection
DestroyEnvironmentBlock
EnterCriticalPolicySection
FreeGPOListW
UnregisterGPNotification
RegisterGPNotification
CreateEnvironmentBlock
GetProfilesDirectoryW
GetAppliedGPOListW

version

GetFileVersionInfoSizeW
VerInstallFileA
GetFileVersionInfoA

ntdll

ZwQueryDefaultLocale
ZwFlushWriteBuffer
ZwClose
NtAccessCheck
RtlZeroHeap
RtlUpcaseUnicodeStringToCountedOemString
RtlUnwind
RtlRunDecodeUnicodeString
RtlProtectHeap
RtlNtStatusToDosError
RtlDeleteNoSplay
NtSetValueKey
NtSetIoCompletion
NtReplyWaitReplyPort
NtPlugPlayControl
NtOpenProcess
NtCreateDirectoryObject

kernel32

FindFirstVolumeMountPointW
WriteProfileStringW
WideCharToMultiByte
WaitCommEvent
VirtualQuery
VirtualProtect
VerLanguageNameW
VerLanguageNameA
UnmapViewOfFile
UnhandledExceptionFilter
SetVolumeMountPointA
SetStdHandle
SetLastError
SetCommState
OpenSemaphoreA
LocalCompact
IsValidLanguageGroup
InitializeCriticalSectionAndSpinCount
HeapUnlock
HeapAlloc
GetVolumePathNameW
GetVolumeInformationA
GetTickCount
GetStringTypeExW
GetStringTypeExA
GetStringTypeA
GetShortPathNameW
GetProfileStringW
GetProcAddress
GetPrivateProfileSectionNamesA
GetFileSize
GetFileAttributesExW
GetCommandLineA
FindFirstVolumeMountPointA
ExitProcess
EraseTape
EnumLanguageGroupLocalesA
CallNamedPipeA
CancelIo
ChangeTimerQueueTimer
CopyFileExA
CreateProcessA
DeleteAtom
DeleteFileA

user32

CreateCursor
DefDlgProcA
FillRect
GetCursor
GetDC
GetDlgItem
GetFocus
LoadCursorA
LoadIconA
PostMessageA
SendMessageA
ShowCursor
UpdateWindow
CharPrevA

Exports

Exports

ImnkQzsZ
NagdYe
Olbiuw
UyxsmsdbAyTbBw
audaknajl
bhcyYckPkvtxrisewul
enuiWtniyeuscidJvwb
ezosyqirXhswcMtwgb
ftmjBpltpcAYunck
hiJxh
lqaybflInvvlIoi
nmthKlfLxpXIabxf
qAlchjufoHpeeF
qbtjsjqveQsNnEglyhr
qsjmpHtzidaer
sBbqeviiBaan
vvvEjtwioudjzltwlop
vzdNpcswce

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 523KB - Virtual size: 523KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e93bb4ec98cbd0db060d70b649aefc44

Headers

File Characteristics

Imports

userenv

version

ntdll

kernel32

user32

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 55KB

.data Size: 523KB - Virtual size: 523KB

.rsrc Size: 51KB - Virtual size: 51KB

.text
Size: 56KB - Virtual size: 55KB

.data
Size: 523KB - Virtual size: 523KB

.rsrc
Size: 51KB - Virtual size: 51KB