3ab04a314cb3dcb67f302da48928788e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3ab04a314cb3dcb67f302da48928788e_JaffaCakes118
Size

233KB
MD5

3ab04a314cb3dcb67f302da48928788e
SHA1

f906616dbfc85d59f49ebd5e668216dcc0885ed0
SHA256

2223fc98af63359c2910005f34fff7e496fb6947ba6e1a036d44b44d147f3951
SHA512

24c5861e526301c69daa83e8930cc8a6cbcf52b22fc1d7ac7901c9ca1ac0f5576b9a00e650cbe3020a297a279ff24acdfa797df70e05dc29cb4e73365b256c41
SSDEEP

6144:SVmZXJQ+2aoTA5aQVqtFkbiBIhK+ye+63+:TjsTAVVqv8aI3yH5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/PO.scr

Files

3ab04a314cb3dcb67f302da48928788e_JaffaCakes118
.zip
PO.scr
.exe windows:4 windows x86 arch:x86

cddb1ba304de3fd640197ef6a2449b02

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\MYProject\Stub\Vc7\S7\S7\Release\S7.pdb

Imports

mfc71u

ord2829
ord4301
ord2708
ord2832
ord2534
ord2640
ord2527
ord3712
ord3713
ord3703
ord2638
ord3943
ord4475
ord4255
ord3327
ord566
ord757
ord6086
ord593
ord5221
ord5113
ord334
ord956
ord547
ord4025
ord5971
ord1049
ord1117
ord1121
ord3824
ord5178
ord4206
ord4729
ord4884
ord4574
ord2011
ord1662
ord1661
ord1542
ord5908
ord1611
ord1608
ord3940
ord1392
ord4238
ord5148
ord1899
ord5067
ord6271
ord4179
ord5199
ord3397
ord4716
ord4276
ord1591
ord5956
ord5231
ord5229
ord920
ord925
ord929
ord927
ord931
ord2384
ord2404
ord2388
ord2394
ord2392
ord2390
ord2407
ord2402
ord2386
ord2409
ord2397
ord2379
ord2381
ord2399
ord2169
ord2163
ord1513
ord6273
ord3796
ord6275
ord3339
ord4961
ord1353
ord5171
ord1955
ord1647
ord1646
ord1590
ord5196
ord2856
ord4480
ord4256
ord3176
ord354
ord605
ord764
ord762
ord3642
ord3460
ord629
ord577
ord1430
ord5319
ord2897
ord383
ord2237
ord1904
ord2725
ord5003
ord5006
ord4129
ord2933
ord4898
ord940
ord5352
ord2986
ord2419
ord2418
ord4013
ord1548
ord5911
ord3939
ord1393
ord5144
ord5201
ord2164
ord1297
ord4271
ord4259
ord742
ord740
ord635
ord562
ord553
ord552
ord395
ord751
ord1994
ord2136
ord2135
ord5855
ord4293
ord5161
ord1047
ord3070
ord3395
ord4109
ord4035
ord3639
ord3444
ord4560
ord2608
ord2615
ord6234
ord2007
ord2042
ord5152
ord5588
ord1370
ord5408
ord2736
ord5491
ord4251
ord4846
ord4733
ord1913
ord4216
ord3034
ord2762
ord5930
ord6039
ord4476
ord4258
ord368
ord616
ord4699
ord3646
ord3484
ord2084
ord4438
ord4437
ord4784
ord4198
ord4775
ord4381
ord4974
ord4166
ord4175
ord4771
ord4380
ord4395
ord4393
ord4375
ord4378
ord4373
ord4858
ord4855
ord3968
ord4233
ord5147
ord5210
ord3338
ord1352
ord4267
ord5163
ord4585
ord1894
ord2953
ord3225
ord340
ord596
ord3675
ord3582
ord5169
ord2982
ord3323
ord1198
ord2531
ord5562
ord5209
ord5226
ord4562
ord3942
ord2239
ord5222
ord5220
ord2925
ord1911
ord3826
ord5378
ord6215
ord5096
ord1007
ord3800
ord5579
ord2009
ord2054
ord4320
ord6274
ord3795
ord6272
ord4008
ord4032
ord3677
ord4461
ord4463
ord2609
ord3635
ord1079

msvcr71

_controlfp
__security_error_handler
_onexit
__dllonexit
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_amsg_exit
_wcmdln
_cexit
_XcptFilter
__CxxFrameHandler
exit
malloc
memset
_except_handler3
_exit
_c_exit
free

kernel32

Sleep
Process32FirstW
GetModuleFileNameW
CreateFileA
GetModuleFileNameA
InitializeCriticalSection
GetModuleHandleA
GetStartupInfoW
ExitProcess
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
DeleteCriticalSection
CloseHandle
GetVersionExA
GetLastError

user32

SendMessageW
GetCursorPos
MessageBoxW
EnableWindow
UpdateWindow
GetForegroundWindow

advapi32

RegCloseKey

comctl32

ord17

Sections

.text
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cddb1ba304de3fd640197ef6a2449b02

Headers

File Characteristics

PDB Paths

Imports

mfc71u

msvcr71

kernel32

user32

advapi32

comctl32

Sections

.text Size: 28KB - Virtual size: 24KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 108KB - Virtual size: 106KB

.text
Size: 28KB - Virtual size: 24KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 108KB - Virtual size: 106KB