feea87c720feea7f70eb6743208a7eac_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

feea87c720feea7f70eb6743208a7eac_JaffaCakes118
Size

176KB
MD5

feea87c720feea7f70eb6743208a7eac
SHA1

d739dce398a017ff3e713eaf9fad3a6586631f9b
SHA256

e11acc493226dcc7f03d481fd15d28d9304bbc95f55bd106655164fe89c3344c
SHA512

88231b4e7feca3a2219643426bab42c7005fa4bf894903232d1143a4e1a142dc5314e29ea04efc0c9a0f2d31b9c5b5cd124f10a7a65f95fdca826d9691a61d98
SSDEEP

3072:2s/+5mazwywvRCN1kCbYuKLslNjJ4lZAIVNWX6f6ZV885s7ZhKIZV5YHR2eDgw:omUwzvRSfb9KLYWqK6TT5s7ZhKIZXDK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
feea87c720feea7f70eb6743208a7eac_JaffaCakes118

Files

feea87c720feea7f70eb6743208a7eac_JaffaCakes118
.exe windows:4 windows x86 arch:x86

24a8097e2a663113b0c951bb1c44be47

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\depot\installers\Bauhaus\Tools\msi\setup.exe\BOTH_DEBUG\setup.pdb

Imports

kernel32

lstrcpynA
GetSystemDirectoryA
CloseHandle
GetExitCodeProcess
CreateProcessA
WideCharToMultiByte
LockResource
LoadResource
FindResourceA
LocalFree
FormatMessageA
lstrcmpA
GetVersionExA
CreateMutexA
GlobalFree
GlobalAlloc
GetCurrentProcess
GetEnvironmentVariableA
OutputDebugStringA
MultiByteToWideChar
GetModuleFileNameA
GetLastError
lstrlenA
lstrcpyA
CompareStringA
lstrcatA
GetFullPathNameA
GetFileAttributesA
LoadLibraryA
LCMapStringW
LCMapStringA
SetStdHandle
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetLocaleInfoA
GetSystemInfo
VirtualProtect
InterlockedExchange
VirtualQuery
GetOEMCP
GetACP
GetCPInfo
SetFilePointer
SetConsoleCtrlHandler
VirtualAlloc
HeapReAlloc
HeapAlloc
GetStringTypeW
GetStringTypeA
FlushFileBuffers
RtlUnwind
VirtualFree
HeapFree
HeapCreate
HeapDestroy
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetProcAddress
FreeLibrary
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
InterlockedIncrement
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
TerminateProcess
ExitProcess
IsBadWritePtr
IsBadReadPtr
HeapValidate
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement

advapi32

GetTokenInformation
RegOpenKeyExA
AllocateAndInitializeSid
OpenProcessToken
RegQueryValueExA
EqualSid
FreeSid
RegCloseKey

user32

ShowWindow
ExitWindowsEx
CharPrevA
MessageBoxA
LoadStringA
SetCursor
LoadCursorA
GetDlgItem
GetSystemMetrics
wsprintfA
CharNextA
MsgWaitForMultipleObjects
CreateDialogParamA
SetWindowTextA
MoveWindow
SetDlgItemTextA
SetFocus
DestroyWindow
SetForegroundWindow
LoadIconA
SendMessageA
PeekMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
GetWindowRect
SystemParametersInfoA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

comctl32

InitCommonControlsEx

urlmon

URLDownloadToCacheFileA

wininet

InternetCanonicalizeUrlA
DeleteUrlCacheEntry

Sections

.text
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

24a8097e2a663113b0c951bb1c44be47

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

user32

version

comctl32

urlmon

wininet

Sections

.text Size: 76KB - Virtual size: 75KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 76KB - Virtual size: 76KB

.text
Size: 76KB - Virtual size: 75KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 76KB - Virtual size: 76KB