1198a1ba91ebad3195d99f988cbce153_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

1198a1ba91ebad3195d99f988cbce153_JaffaCakes118
Size

25KB
MD5

1198a1ba91ebad3195d99f988cbce153
SHA1

444ad60fa6f3d74a27830856f985ce465f3709d4
SHA256

6820b3d43b24d36fbfce6657828f795d35d3c893752a85b16ce04ede198af5fc
SHA512

ca052fc74e6adc3fb114af5fb2c39017178275a64ee4f9b7527e3182ee3912289d49f512e87214be2a6f9b2d22323e842607bcdea6d6591afb7be74cd45f963b
SSDEEP

384:h9twSaUf1NbGIj+kuwK+rUXOC6epbZBnQ01x8pMYuL9x1Fvo5TSV3eD7h4Y7nk0h:FwSx1NbRxxPYtBr1S3uZFvoK3khDzP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1198a1ba91ebad3195d99f988cbce153_JaffaCakes118

Files

1198a1ba91ebad3195d99f988cbce153_JaffaCakes118
.exe windows:4 windows x86 arch:x86

99c0f316d3309fef7323013075cd9d9a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

recv
select
socket
htons
send
closesocket
ioctlsocket
gethostbyname
inet_addr
sendto
connect
WSAStartup
WSACleanup

urlmon

URLDownloadToFileA

kernel32

FindFirstFileA
LocalFree
GetStartupInfoA
GetLogicalDriveStringsA
GetDriveTypeA
CreateDirectoryA
CreateFileA
WriteFile
CloseHandle
ReadProcessMemory
OpenProcess
Module32Next
DeleteFileA
Sleep
TerminateProcess
SetFileAttributesA
Module32First
CreateToolhelp32Snapshot
Process32Next
Process32First
GetModuleFileNameA
GetModuleHandleA
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
VirtualAlloc
CreateProcessA
ExpandEnvironmentStringsA
FreeLibrary
lstrcpyA
GetProcAddress
lstrlenA
lstrcatA
FindClose
LoadLibraryA
GetLastError
CopyFileA
GetFileAttributesA
lstrcmpiA
GetWindowsDirectoryA
CreateThread
ExitProcess
GetLocaleInfoA
GetTempPathA
GetTickCount
ExitThread
GlobalUnlock
GlobalLock
GlobalAlloc
CreateMutexA
SetErrorMode
GetVersionExA

shell32

ShellExecuteA

advapi32

RegCreateKeyExA
RegDeleteValueA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey

user32

SetClipboardData
keybd_event
FindWindowA
wsprintfA
EmptyClipboard
OpenClipboard
VkKeyScanA
ShowWindow
SetFocus
SetForegroundWindow
BlockInput
IsWindow
SendMessageA
CloseClipboard

msvcrt

_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
__getmainargs
_acmdln
_except_handler3
_controlfp
_CxxThrowException
??1type_info@@UAE@XZ
??3@YAXPAX@Z
exit
_XcptFilter
_exit
malloc
_ftol
strncat
srand
strtok
atoi
strchr
strncmp
memmove
strncpy
strlen
_snprintf
memset
strcpy
strcmp
sprintf
strstr
strcat
memcpy
rand
fclose
fprintf
fopen

ole32

CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantInit
SysAllocString
VariantClear

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

99c0f316d3309fef7323013075cd9d9a

Headers

File Characteristics

Imports

ws2_32

urlmon

kernel32

shell32

advapi32

user32

msvcrt

ole32

oleaut32

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 9KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 9KB

.reloc
Size: 2KB - Virtual size: 1KB