00e17747dcfc7fbc69cdffc5a66de6f3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

00e17747dcfc7fbc69cdffc5a66de6f3_JaffaCakes118
Size

64KB
MD5

00e17747dcfc7fbc69cdffc5a66de6f3
SHA1

4d69cb4669553e436a7043f5e74b39aadeabd4d5
SHA256

0e2e3bf76ce5148ddfaed6ab499ba8aebbb395b8873b999c2f1762240028f448
SHA512

1d25a8b1d1c710dfb828863744c941e3460064595d005873cd6421bba5f8e09151904a10f05ddf7691a2b97b6cae7673d74e6c99eb6713fcb924ea8ae9c16e66
SSDEEP

1536:kgtWaW7jcIVs0XNTfa9JADSwAxioVGXG5OHycjMQd:sS7Mo0jz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00e17747dcfc7fbc69cdffc5a66de6f3_JaffaCakes118

Files

00e17747dcfc7fbc69cdffc5a66de6f3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

676103c2cb701f05f4d6e26686c06370

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetModuleHandleA
CreateThread
Sleep
TerminateThread
FindResourceA
RemoveDirectoryA
DeleteFileA
TerminateProcess
OpenProcess
LoadResource
GetCurrentProcess
LockResource
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
ReadFile
SetEndOfFile
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
CreateFileA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
IsBadWritePtr
HeapReAlloc
VirtualAlloc
SetFilePointer
VirtualFree
HeapCreate
HeapDestroy
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
GetStringTypeW
FreeEnvironmentStringsW
RtlUnwind
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapAlloc
HeapFree
GetLastError
CloseHandle
WriteFile
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA

advapi32

OpenProcessToken
CreateProcessAsUserA

user32

ShowWindow
GetMessageA
TranslateMessage
DispatchMessageA
GetClassNameA
CloseDesktop
CreateDesktopA
EnumDesktopWindows
SetWindowLongA
IsWindowVisible
IsWindowEnabled
GetWindowTextA
EnumChildWindows
SendMessageA
DefWindowProcA
RegisterClassA
CreateWindowExA
GetWindowLongA

shell32

ShellExecuteA
SHGetSpecialFolderPathA

wininet

InternetOpenA
InternetCloseHandle
InternetReadFile
HttpQueryInfoA
InternetOpenUrlA

psapi

EnumProcessModules
GetModuleFileNameExA
EnumProcesses

Sections

.text
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

676103c2cb701f05f4d6e26686c06370

Headers

File Characteristics

Imports

kernel32

advapi32

user32

shell32

wininet

psapi

Sections

.text Size: 32KB - Virtual size: 29KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 9KB

.rsrc Size: 20KB - Virtual size: 19KB

.text
Size: 32KB - Virtual size: 29KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 9KB

.rsrc
Size: 20KB - Virtual size: 19KB