0ea301069829292ca56786d311e85f74_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

0ea301069829292ca56786d311e85f74_JaffaCakes118
Size

26KB
MD5

0ea301069829292ca56786d311e85f74
SHA1

5a095dbd44b4a9d14beb500624be12c981f0094b
SHA256

a907bf4a17b62c569e9f32f48eba75257c8a9f5fa09e588e5fe939786ec1af05
SHA512

b35d0c0602073bddeb75cb338cdd61a529b5c5d4811821512a20569b97f9981988732804e13bbc042a3566b4d86fb1a8e6f59388eebd31225aa38e3797c28178
SSDEEP

768:8caEIHh5WPJbKeaMMpWkehlmsNyCiyWlmO:8cajsbaZpW1Xms2yomO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ea301069829292ca56786d311e85f74_JaffaCakes118

Files

0ea301069829292ca56786d311e85f74_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4e7fd9b0985d406a610015159e01de70

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
sprintf
fclose
strncpy
strlen
strcat
strcmp
memmove
strcpy
atoi
strstr
_strnicmp
sscanf
localtime
mktime
memcpy

kernel32

GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
WriteFile
HeapFree
CloseHandle
HeapAlloc
InitializeCriticalSection
FreeLibrary
MultiByteToWideChar
CopyFileA
SetFileAttributesA
GetDriveTypeA
FindFirstFileA
FindClose
GetFileAttributesA
GetModuleFileNameA
GetCurrentProcess
DuplicateHandle
CreatePipe
GetStdHandle
CreateProcessA
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
CreateFileA
Sleep
GetLocalTime
GetCurrentThreadId
GetTickCount
HeapReAlloc

comctl32

InitCommonControls
InitCommonControlsEx

user32

DestroyWindow
GetWindow
SetActiveWindow
RemovePropA
SendMessageA
UnregisterClassA
DestroyAcceleratorTable
LoadIconA
LoadCursorA
SetCursorPos
LoadImageA
SetCursor
GetWindowLongA
GetParent
MapWindowPoints
MoveWindow
SystemParametersInfoA
GetWindowRect
GetSystemMetrics
GetKeyState
SetCapture
PostMessageA
GetCursorPos
ReleaseCapture
DestroyIcon

gdi32

CreateSolidBrush
CreatePen
DeleteObject
GetStockObject
GetObjectType

advapi32

RegCreateKeyExA
RegConnectRegistryA
RegCloseKey
RegOpenKeyExA
RegSetValueExA

ole32

RevokeDragDrop
CoInitialize

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
ShellExecuteExA

wsock32

closesocket
WSACleanup
WSAStartup
socket
inet_addr
gethostbyname
htons
connect
ioctlsocket
send
sendto
recvfrom
recv
WSAGetLastError

Sections

.code
Size: 1024B - Virtual size: 1007B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 293B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 700B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4e7fd9b0985d406a610015159e01de70

Headers

File Characteristics

Imports

msvcrt

kernel32

comctl32

user32

gdi32

advapi32

ole32

shell32

wsock32

Sections

.code Size: 1024B - Virtual size: 1007B

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 512B - Virtual size: 293B

.data Size: 8KB - Virtual size: 8KB

.rsrc Size: 1024B - Virtual size: 700B

.code
Size: 1024B - Virtual size: 1007B

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 512B - Virtual size: 293B

.data
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 1024B - Virtual size: 700B