0fda3cfe8951293fcf4f7ecb6cba0be6_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

0fda3cfe8951293fcf4f7ecb6cba0be6_JaffaCakes118
Size

382KB
MD5

0fda3cfe8951293fcf4f7ecb6cba0be6
SHA1

33a7f6e39fb21883ed76df241f7369854db9b5e2
SHA256

9cbbe1f2cdb08a6d5facee3e32a3c9f623842fa3ca8f6b796752d277b7e19ab3
SHA512

772020b40bcbbd9b9a6674815994e99d88f5d37d13f6f9146f5573b20d45065957cd80c2d07e34555b635464377a635facaabca4603fad7474455b10276f4a4e
SSDEEP

6144:byx9Uml0lZHL2NvGagpgQICpktxCO0Vq9rQjWMbTbGlra8UP+O3PZ6B0xWOVOKKM:byx9Uml0lZHL2NvGaglT60VKrQjFfbGA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0fda3cfe8951293fcf4f7ecb6cba0be6_JaffaCakes118

Files

0fda3cfe8951293fcf4f7ecb6cba0be6_JaffaCakes118
.exe windows:5 windows x86 arch:x86

87bee736ea806ead79e14452b6c8f42c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_BIND
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_SYSTEM

PDB Paths

O:\maybe\authored\activity\normati.pdb

Imports

kernel32

GetTimeZoneInformation
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
InterlockedDecrement
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
RtlUnwind
HeapReAlloc
HeapSize
SetStdHandle
WriteConsoleW
LCMapStringW
GetStringTypeW
FlushFileBuffers
CreateFileW
CloseHandle
LoadLibraryW
GetLastError
CreateFileA
SetErrorMode
TlsSetValue
TlsGetValue
TlsAlloc
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
IsProcessorFeaturePresent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameW
GetStdHandle
WriteFile
GetModuleHandleW
LoadLibraryA
GetVolumeInformationA
ExitProcess
HeapCreate
GetProcessHeap
GetProcessHandleCount
GetProcAddress
lstrlenA
Sleep
GetCurrentProcess
GetModuleHandleA
SetFilePointer
GetConsoleCP
CompareStringW
GetConsoleMode
TerminateProcess
DecodePointer
EncodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
HeapFree
HeapAlloc
SetCurrentDirectoryW
GetCommandLineA
HeapSetInformation
SetEnvironmentVariableA

user32

EmptyClipboard
EnumWindowStationsW
GetIconInfo
LoadImageW
ClientToScreen
GetFocus
DestroyWindow
DispatchMessageA
DeleteMenu
GetSystemMenu
wsprintfA
CreateWindowExA
SystemParametersInfoA
GetSystemMetrics
DrawTextA
SetWindowPos
SendMessageA
RegisterHotKey
GetDC
FillRect
ReleaseDC
GetWindowRect
GetClientRect
BeginPaint
DrawIconEx
EndPaint
OpenClipboard
SetWindowTextA
CopyImage
SetClipboardData
CloseClipboard
EndDialog
MessageBoxA
DefWindowProcA
PostQuitMessage
LoadBitmapA
LoadImageA
DestroyIcon

gdi32

CreateSolidBrush
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteDC
GetStockObject
PatBlt
BitBlt
GetObjectA
CreateBitmap
Rectangle
Ellipse
TextOutA
GetObjectW
StretchBlt

advapi32

RegCloseKey
RegOpenKeyW
ReadEventLogA
GetOldestEventLogRecord
OpenEventLogW
RegQueryValueExW

shell32

DragFinish
DragQueryFileA
SHGetFolderPathA

ole32

CreateBindCtx
CoInitialize
CoGetClassObject

psapi

GetProcessMemoryInfo

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueA
VerQueryValueW
GetFileVersionInfoSizeA
GetFileVersionInfoA

shlwapi

PathAppendA

comctl32

ImageList_DragLeave
ImageList_DragShowNolock
ImageList_Create
ImageList_AddMasked
ImageList_DragEnter
ImageList_Destroy
ImageList_BeginDrag
ImageList_ReplaceIcon
ImageList_EndDrag
ImageList_Add

imm32

ImmGetOpenStatus
ImmSetOpenStatus
ImmReleaseContext
ImmGetContext

wsnmp32

ord202

msi

ord57

urlmon

CoInternetGetSession

sensapi

IsNetworkAlive

Sections

.text
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 224KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

87bee736ea806ead79e14452b6c8f42c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

psapi

version

shlwapi

comctl32

imm32

wsnmp32

msi

urlmon

sensapi

Sections

.text Size: 55KB - Virtual size: 54KB

.rdata Size: 224KB - Virtual size: 224KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 91KB - Virtual size: 90KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 55KB - Virtual size: 54KB

.rdata
Size: 224KB - Virtual size: 224KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 91KB - Virtual size: 90KB

.reloc
Size: 6KB - Virtual size: 6KB