11e01803e7e45cc6bb6f6cc3210bb5af_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

11e01803e7e45cc6bb6f6cc3210bb5af_JaffaCakes118
Size

700KB
MD5

11e01803e7e45cc6bb6f6cc3210bb5af
SHA1

746b673663692072375952b619712e1e25f395b4
SHA256

b67b8ff0f3a8654e0feb87c16d2be5a6ad6fda5a62b75165edc12634e7e5107b
SHA512

13883e791f9d1a9a7b9aa2917f9c0d8e18aadebf98f163ce4b3b3755fc36bc3f18bf59e58d93832c2694c3aef637a87394ccf8ec94d908dd64bce49a22cfe025
SSDEEP

12288:MoYMNDSG8Wjq0x3WRt1dSBID8rW+aq6aQ:MHESGc5RtWBjQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11e01803e7e45cc6bb6f6cc3210bb5af_JaffaCakes118

Files

11e01803e7e45cc6bb6f6cc3210bb5af_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f878c3fd7b5852689aa3e47fea0fe508

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcatA
lstrlenA
GetModuleHandleA
_llseek
_lread
GlobalReAlloc
_hread
_lwrite
OpenFile
_lclose
LocalAlloc
LocalFree
GlobalHandle
GlobalUnlock
lstrcpyA
GetWindowsDirectoryA
LoadLibraryA
FreeLibrary
WinExec
DeleteFileA
GlobalFree
GlobalAlloc
GlobalLock
GetSystemDefaultLangID
GetModuleFileNameA
GetEnvironmentVariableA
GetStartupInfoA
GetCommandLineA

user32

InflateRect
GetParent
CopyIcon
SetCursor
PtInRect
ReleaseCapture
RedrawWindow
SetCapture
MessageBeep
EnableWindow
KillTimer
SetTimer
EnableMenuItem
IsIconic
DrawIcon
GetDC
ReleaseDC
GetSystemMenu
AppendMenuA
GetMenu
ModifyMenuA
GetSubMenu
CheckMenuItem
LoadIconA
GetClientRect
GetWindowRect
SendMessageA
LoadCursorA
InvalidateRect
IsWindow
GetSystemMetrics
SetWindowLongA

gdi32

CreateFontIndirectA
CreateFontA
Rectangle
RealizePalette
GetTextExtentPoint32A
GetObjectA
GetStockObject
GetNearestPaletteIndex
DeleteObject
GetPaletteEntries
CreatePalette
SetStretchBltMode
StretchDIBits
SetDIBitsToDevice

advapi32

RegQueryValueA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA

shell32

DragQueryFileA
DragFinish
ShellExecuteA

winmm

mixerGetLineControlsA
mixerGetLineInfoA
mixerOpen
mixerGetNumDevs
mixerClose
mixerGetControlDetailsA
mixerSetControlDetails
mciSendCommandA

mfc42

ord3692
ord2452
ord1200
ord2915
ord5572
ord941
ord6880
ord6358
ord3797
ord3874
ord2864
ord5875
ord4275
ord567
ord2614
ord825
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord815
ord641
ord800
ord809
ord2514
ord2621
ord1134
ord537
ord3619
ord5265
ord4376
ord4853
ord4998
ord6052
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5280
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord4627
ord4425
ord3597
ord860
ord540
ord324
ord3626
ord3663
ord2414
ord2370
ord2302
ord4234
ord1641
ord2860
ord6197
ord6199
ord3092
ord4710
ord1146
ord1168
ord556
ord2763
ord5710
ord5683
ord1088
ord2122
ord2639
ord6380
ord1175
ord925
ord823
ord858
ord922
ord2818
ord2863
ord2379
ord5787
ord283
ord2859
ord755
ord470
ord538
ord2642
ord1979
ord665
ord3318
ord924
ord926
ord5186
ord4278
ord4203
ord3177
ord3499
ord2515
ord355
ord354
ord2764
ord5791
ord6378
ord2393
ord690
ord5207
ord389
ord939
ord6928
ord4129
ord4224
ord5290
ord3402
ord6055
ord1776
ord3721
ord795
ord1576

msvcrt

_setmbcp
calloc
getenv
sscanf
fflush
_CIpow
sprintf
_strcmpi
_open
_read
_lseek
_close
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
free
malloc
fclose
fwrite
fopen
fprintf
_iob
fread
fseek
__CxxFrameHandler
_mbscmp
_ftol
strstr
_mbsstr
longjmp
_setjmp3
printf
strncmp
__dllonexit
_onexit
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr

Sections

.text
Size: 188KB - Virtual size: 188KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 32KB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 156KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f878c3fd7b5852689aa3e47fea0fe508

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

winmm

mfc42

msvcrt

Sections

.text Size: 188KB - Virtual size: 188KB

.rdata Size: 68KB - Virtual size: 67KB

.data Size: 32KB - Virtual size: 2.6MB

.rsrc Size: 156KB - Virtual size: 176KB

.text Size: 116KB - Virtual size: 116KB

.text Size: 116KB - Virtual size: 116KB

.text
Size: 188KB - Virtual size: 188KB

.rdata
Size: 68KB - Virtual size: 67KB

.data
Size: 32KB - Virtual size: 2.6MB

.rsrc
Size: 156KB - Virtual size: 176KB

.text
Size: 116KB - Virtual size: 116KB

.text
Size: 116KB - Virtual size: 116KB