00473c17d7d01ba97147ea46e1fab66d_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

00473c17d7d01ba97147ea46e1fab66d_JaffaCakes118
Size

2.7MB
MD5

00473c17d7d01ba97147ea46e1fab66d
SHA1

898d1a1c095a388eba3c3dc213c9133ffe1a528c
SHA256

735dbc784015d89fd6ce5c519553abe221f5e6a098ac7dd483da43279943ad4c
SHA512

4f885fdd242bfc5f950265fd0f39fea59ae80b466f0f1b8bed7d7ca15bcd31b4b91bd4cffed47977e51e5cfd61f247f02252702afe046f257df07b8bbfdb56b6
SSDEEP

49152:xitV1YKeMH6LQ8iR2acHU1aKKbw9CFRdnozTt9KoQ6nzmb3yeB0wbzEu9mpu1sCW:xi1YKNOicacmubhFQzB97zmblB0wbzRo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00473c17d7d01ba97147ea46e1fab66d_JaffaCakes118

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

Files

00473c17d7d01ba97147ea46e1fab66d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

86cf9c5fe7575b03fdb99ed06c05dad4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetReadFile
InternetOpenUrlW
HttpQueryInfoW
InternetCloseHandle
InternetOpenW
InternetSetOptionW

kernel32

DeleteFileW
GetModuleFileNameA
CreateFileA
GetFileSize
SetFilePointer
ReadFile
GetCurrentThread
FreeLibrary
GetModuleFileNameW
SetLastError
CreateFileW
WriteFile
LoadLibraryA
GetProcAddress
GetModuleHandleA
VirtualProtect
GetCurrentProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
lstrlenA
LoadResource
LockResource
SizeofResource
FindResourceW
FindResourceExW
GetACP
FormatMessageW
GetTickCount
Sleep
GetThreadContext
SetThreadContext
VirtualQuery
InterlockedCompareExchange
VirtualFree
FlushInstructionCache
VirtualAlloc
GetCurrentThreadId
SuspendThread
ResumeThread
GetModuleHandleW
SetEndOfFile
CreateDirectoryW
GetFileAttributesW
WaitForSingleObject
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
IsValidCodePage
GetOEMCP
GetFileType
SetHandleCount
HeapReAlloc
HeapCreate
HeapDestroy
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStdHandle
HeapSize
TlsFree
TlsSetValue
OutputDebugStringW
CreateProcessW
GetTempFileNameW
GetTempPathW
CloseHandle
OpenMutexW
CreateMutexW
GetLastError
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetThreadLocale
GetLocaleInfoW
TlsAlloc
TlsGetValue
ExitProcess
GetCPInfo
LCMapStringW
LCMapStringA
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetCommandLineA
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
RaiseException
RtlUnwind

user32

UnregisterClassA
CreateWindowExW
RegisterClassW
LoadCursorW
LoadIconW
DefWindowProcW
SetForegroundWindow
SetWindowPos
IsZoomed
AttachThreadInput
GetWindowThreadProcessId
ShowWindow
IsWindowVisible
GetForegroundWindow
IsWindow
MessageBoxW
PostQuitMessage

gdi32

GetStockObject

advapi32

RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
RegEnumValueW
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegEnumKeyExW

shell32

SHGetFolderPathW

shlwapi

PathFileExistsW

Sections

.text
Size: 229KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gms
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

86cf9c5fe7575b03fdb99ed06c05dad4

Headers

File Characteristics

Imports

wininet

kernel32

user32

gdi32

advapi32

shell32

shlwapi

Sections

.text Size: 229KB - Virtual size: 232KB

.rdata Size: 64KB - Virtual size: 64KB

.data Size: 8KB - Virtual size: 20KB

.gms Size: 512B - Virtual size: 4KB

.rsrc Size: 10KB - Virtual size: 12KB

.text
Size: 229KB - Virtual size: 232KB

.rdata
Size: 64KB - Virtual size: 64KB

.data
Size: 8KB - Virtual size: 20KB

.gms
Size: 512B - Virtual size: 4KB

.rsrc
Size: 10KB - Virtual size: 12KB