3e1f88c509604fd4cf708d02815a87e9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3e1f88c509604fd4cf708d02815a87e9_JaffaCakes118
Size

416KB
MD5

3e1f88c509604fd4cf708d02815a87e9
SHA1

d4e6bba8e4a5d95f85b939609285278789e67b80
SHA256

d3cd33e54f501ead6251570d8e9e152cca2fff68925aeebb71e8d446a669c4b7
SHA512

4acfc6552f1f61cd33b83aee2e14f3c6f1c1bc93faf747a595664fa731cdc73653056097224bd776f70da337f3ce6add679d4e4aebd6ec8efae610da1cc1bb0e
SSDEEP

12288:VRdRVG208a11Mdy/pWmFKI4Zrmor7k4k6dG+D:gKI4ZrmoPDB0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e1f88c509604fd4cf708d02815a87e9_JaffaCakes118

Files

3e1f88c509604fd4cf708d02815a87e9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ca0e169fbd17b12418111a710d05d69d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetOEMCP
GetCommandLineA
Sleep
FreeLibrary
RtlUnwind
IsDebuggerPresent
FreeEnvironmentStringsW
GetCurrentProcess
HeapDestroy
VirtualAlloc
TlsGetValue
SetLastError
HeapReAlloc
GetTimeFormatA
GetEnvironmentStringsW
GetStringTypeW
GetLastError
TlsFree
GetModuleFileNameA
GetLocaleInfoW
InterlockedIncrement
ExitProcess
GetStartupInfoA
InterlockedDecrement
LCMapStringA
LoadLibraryA
GetTickCount
GetSystemTimeAsFileTime
HeapSize
GetFileType
MultiByteToWideChar
QueryPerformanceCounter
VirtualUnlock
WideCharToMultiByte
EnterCriticalSection
VirtualFree
GetCurrentThreadId
GetEnvironmentStrings
HeapAlloc
GetVersionExA
HeapFree
EnumResourceNamesA
TlsSetValue
GetCurrentProcessId
FreeEnvironmentStringsA
IsValidCodePage
InitializeCriticalSection
SetEnvironmentVariableW
LeaveCriticalSection
GetDateFormatA
GetStdHandle
IsValidLocale
GetLocaleInfoA
SetHandleCount
WriteFile
CompareStringA
GetACP
GetModuleHandleA
GetStringTypeExW
GetProcessHeap
EnumSystemLocalesA
GetTimeZoneInformation
UnhandledExceptionFilter
DeleteCriticalSection
CompareStringW
GetCurrentThread
LCMapStringW
GetProcAddress
GetStringTypeA
GetUserDefaultLCID
GetCPInfo
SetUnhandledExceptionFilter
InterlockedExchange
SetConsoleCtrlHandler
TerminateProcess
HeapCreate
VirtualQuery
SetEnvironmentVariableA
TlsAlloc

advapi32

CryptDecrypt
LookupAccountNameA
LookupPrivilegeDisplayNameA
LookupPrivilegeNameA
RegRestoreKeyA
InitiateSystemShutdownW
RegReplaceKeyW
CryptSetHashParam
CryptGetHashParam
LookupAccountSidW
RegDeleteValueA
RegLoadKeyA
RegSetValueW
RegEnumValueW
CryptAcquireContextW
RegCloseKey
CryptSetProviderExW
LookupAccountSidA
CryptContextAddRef
ReportEventA
RegQueryInfoKeyW
InitiateSystemShutdownA

comdlg32

GetOpenFileNameA
ChooseFontA
FindTextW
ChooseColorW
GetSaveFileNameA
ChooseColorA

Sections

.text
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 274KB - Virtual size: 273KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ca0e169fbd17b12418111a710d05d69d

Headers

File Characteristics

Imports

kernel32

advapi32

comdlg32

Sections

.text Size: 137KB - Virtual size: 136KB

.data Size: 274KB - Virtual size: 273KB

.rsrc Size: 4KB - Virtual size: 4KB

.text
Size: 137KB - Virtual size: 136KB

.data
Size: 274KB - Virtual size: 273KB

.rsrc
Size: 4KB - Virtual size: 4KB