25f1e9b4ca5259e811406f495e8703ad_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

25f1e9b4ca5259e811406f495e8703ad_JaffaCakes118
Size

1.7MB
MD5

25f1e9b4ca5259e811406f495e8703ad
SHA1

bc010a44fdd18c08494f686582f1705a66d7dd8a
SHA256

69a8ce630fdbdc192835f9d35654a589661eeb1b68f61e122a9d72e9cd4a7911
SHA512

aedd132ae51a874d472722489782a54907711b5cb9d0cc92b5fe7ba6e2276777b3f40c5697ab7908af8caf237d9dfa6479299750ecbb3806c5ee82a403228463
SSDEEP

49152:bbfdED6/A4ewEdhhjHHvaLC7k9uvyWtfrXWqO:bh43lhtyL39u3NWqO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
25f1e9b4ca5259e811406f495e8703ad_JaffaCakes118

Files

25f1e9b4ca5259e811406f495e8703ad_JaffaCakes118
.exe windows:4 windows x86 arch:x86

769d8f4fd43c53cb68db6adba585c898

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CryptSetHashParam
RegDeleteKeyA
CryptGenKey
CreateServiceW
CryptDeriveKey
CryptImportKey
AbortSystemShutdownW
CryptAcquireContextW
RegLoadKeyA
CryptSetProviderA
RegSetValueExW

wininet

GopherCreateLocatorA
InternetCreateUrlW
GetUrlCacheEntryInfoExA
FtpFindFirstFileW
InternetSetDialStateA
InternetWriteFileExW
InternetDialW
InternetAttemptConnect
InternetReadFileExA
DeleteUrlCacheGroup
InternetUnlockRequestFile
InternetCheckConnectionA
GetUrlCacheEntryInfoW
InternetConfirmZoneCrossingW
GopherGetLocatorTypeW
InternetCanonicalizeUrlW
InternetTimeToSystemTimeW
InternetCreateUrlA
HttpSendRequestW
LoadUrlCacheContent
InternetAutodialHangup
FtpDeleteFileW
InternetSetOptionW

comdlg32

PrintDlgA
PrintDlgW
GetFileTitleA
ReplaceTextW
GetSaveFileNameA
PageSetupDlgW

gdi32

SetICMProfileA
CheckColorsInGamut
ExtCreatePen
StretchBlt
GetWindowExtEx
GetDeviceGammaRamp
CreatePenIndirect
CreatePolyPolygonRgn

kernel32

InterlockedDecrement
TlsGetValue
HeapFree
GetACP
LoadLibraryA
GetCurrentProcess
SetEnvironmentVariableA
GetCurrentThreadId
GetCommandLineA
InterlockedExchange
GetTimeZoneInformation
TlsSetValue
CreateFileW
ExitProcess
GetSystemTimeAdjustment
GetEnvironmentStrings
QueryPerformanceCounter
HeapDestroy
MultiByteToWideChar
LCMapStringW
CompareStringW
GetStartupInfoA
GetProcAddress
HeapReAlloc
VirtualFree
Sleep
HeapCreate
GetStringTypeW
SetConsoleCtrlHandler
GetLastError
EnumResourceTypesW
GetUserDefaultLCID
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
VirtualAlloc
LeaveCriticalSection
TerminateProcess
FindResourceW
EnterCriticalSection
WideCharToMultiByte
EnumSystemLocalesA
GetVersionExA
SetConsoleActiveScreenBuffer
IsValidCodePage
DeleteCriticalSection
GetCPInfo
GetCurrentProcessId
GetModuleHandleA
GetLocaleInfoW
GetCurrentThread
GetFileType
IsDebuggerPresent
FreeEnvironmentStringsA
RtlUnwind
SetLastError
GlobalDeleteAtom
GetLocaleInfoA
GetTickCount
GetProcessHeap
TlsFree
InterlockedIncrement
GetStringTypeA
GlobalFree
VirtualQuery
SetConsoleCP
GetOEMCP
WriteFile
GetEnvironmentStringsW
GetSystemTimeAsFileTime
TlsAlloc
FreeEnvironmentStringsW
GetDateFormatA
SetHandleCount
GetStdHandle
HeapSize
InitializeCriticalSection
GetTimeFormatA
HeapAlloc
SetUnhandledExceptionFilter
GetModuleFileNameA
CompareStringA
VirtualProtectEx
IsValidLocale
FreeLibrary
LCMapStringA

Sections

.text
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1.5MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

769d8f4fd43c53cb68db6adba585c898

Headers

File Characteristics

Imports

advapi32

wininet

comdlg32

gdi32

kernel32

Sections

.text Size: 138KB - Virtual size: 138KB

.data Size: 1.5MB - Virtual size: 1.6MB

.rsrc Size: 5KB - Virtual size: 5KB

.text
Size: 138KB - Virtual size: 138KB

.data
Size: 1.5MB - Virtual size: 1.6MB

.rsrc
Size: 5KB - Virtual size: 5KB