ffba77dbe6c0574346819d7e84a6a396_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ffba77dbe6c0574346819d7e84a6a396_JaffaCakes118
Size

176KB
MD5

ffba77dbe6c0574346819d7e84a6a396
SHA1

b2d10f4fff58491b4d4bb559a5215cd3e2a41703
SHA256

a96e579fac3c3962cf777317a05447011283e3427d41a25499295539ac34d141
SHA512

6e68a1699dbcbcf5b5746804678fba47946421d5732801e9633eb84f33aea167ad5e92e61a1a05047460c2ce1e188802c14e5c55a26fe1f5628f6a0f6e9992a3
SSDEEP

3072:eKQPWiNlo4gItYMUrCF2554yf82AQMIGr:VQ+rXE2n4yf1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffba77dbe6c0574346819d7e84a6a396_JaffaCakes118

Files

ffba77dbe6c0574346819d7e84a6a396_JaffaCakes118
.exe windows:4 windows x86 arch:x86

71b4702d8f268dc894e53161084abab8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
VirtualFree
LoadLibraryA
VirtualAlloc
VirtualProtect
GetProcAddress
GetModuleHandleA
GlobalReAlloc
ResetEvent
MoveFileA
VirtualAllocEx
GetCommandLineA
VirtualFreeEx
LocalLock
GetLocaleInfoA
GetStringTypeW
GlobalLock
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
HeapSize
VirtualQuery
InterlockedExchange
RtlUnwind
HeapReAlloc
HeapAlloc
GetCPInfo
GetOEMCP
GetACP
GetStringTypeA
FlushFileBuffers
HeapFree
HeapCreate
HeapDestroy
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
GetSystemInfo
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetModuleFileNameA
GetStartupInfoA
GetVersionExA
ExitProcess
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle

user32

CreateIcon
IsIconic
GetWindowRect
SetCursorPos
BeginPaint
EndPaint
PostQuitMessage
DefWindowProcA
UpdateWindow
GetMessageA
TranslateMessage
DispatchMessageA
MessageBoxA
ShowWindow
LoadCursorA
GetDesktopWindow
GetDC
GetCursorPos
SetTimer
ReleaseDC

gdi32

PatBlt

shell32

DuplicateIcon

ole32

CoUninitialize

psapi

GetWsChanges
EmptyWorkingSet

msvfw32

DrawDibRealize
DrawDibEnd

gdiplus

GdiplusStartup
GdiplusShutdown

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.sec
Size: 4KB - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsec
Size: 4KB - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dsec
Size: 4KB - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.lsec
Size: 4KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

71b4702d8f268dc894e53161084abab8

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ole32

psapi

msvfw32

gdiplus

Sections

.text Size: 20KB - Virtual size: 17KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 28KB - Virtual size: 28KB

.rsrc Size: 100KB - Virtual size: 96KB

.sec Size: 4KB - Virtual size: 256B

.rsec Size: 4KB - Virtual size: 256B

.dsec Size: 4KB - Virtual size: 256B

.lsec Size: 4KB - Virtual size: 92KB

.text
Size: 20KB - Virtual size: 17KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 28KB - Virtual size: 28KB

.rsrc
Size: 100KB - Virtual size: 96KB

.sec
Size: 4KB - Virtual size: 256B

.rsec
Size: 4KB - Virtual size: 256B

.dsec
Size: 4KB - Virtual size: 256B

.lsec
Size: 4KB - Virtual size: 92KB