52d69ec53eb2fc65c4ebd59249a26a57_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

52d69ec53eb2fc65c4ebd59249a26a57_JaffaCakes118
Size

47KB
MD5

52d69ec53eb2fc65c4ebd59249a26a57
SHA1

a993c1ad747a8c08b77894fe733fd8e1c617a050
SHA256

a1e4004e043b3f45ced76e590b7284b4dd2154c4eb149abb54f3790e844ef86d
SHA512

f53e84aa5bc3fa13dc2c82805c43e592331b6fdedcf2ed1a7d5131c6bb52cec8716440eee73cea2e218b26663ee7058e9ef878c02775dc7420c47d19cab5d5b6
SSDEEP

768:onTcjoIJFsspqU+pfB5XsLOJ6UswIOTGbAAlsFsB8CnfjxMIqAMH9w:UTcsItJ+/JsLMswISqJ6F88YjG6g9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
52d69ec53eb2fc65c4ebd59249a26a57_JaffaCakes118

Files

52d69ec53eb2fc65c4ebd59249a26a57_JaffaCakes118
.exe windows:5 windows x86 arch:x86

77f8c204c89ede62d5f7c003238757b7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Thread32First
LocalSize
GetConsoleProcessList
GetLongPathNameA
Process32FirstW
CreateSemaphoreW
CommConfigDialogW
GetProfileStringW
QueueUserWorkItem
GetPrivateProfileSectionNamesW
UpdateResourceW
VirtualAlloc
DeleteCriticalSection
GetProfileSectionW
RaiseException
Heap32First
AddLocalAlternateComputerNameA
AddAtomW
GetCurrentThread
GetCurrentDirectoryW
LoadLibraryA
LZStart
GlobalGetAtomNameA
GetVolumePathNamesForVolumeNameA
ResumeThread
InterlockedIncrement
CreateFileA
GetBinaryType
UTRegister
GlobalGetAtomNameW
SetTapeParameters
FileTimeToLocalFileTime

msvcrt

_stricoll
_commode
__argc
exit
_adj_fdiv_r
_except_handler3
wcslen
_getdllprocaddr
__p__commode
cos
_getw
__p___winitenv
_heapmin
_fpclass
__getmainargs
_ismbbtrail
___lc_handle_func
_ismbcpunct
_wtoi64
_wstrtime
_mbsspnp
fgetpos
_expand
localtime
_putwch
puts
scanf
log
_ultow
strpbrk
??_Gbad_typeid@@UAEPAXI@Z
_j0
__set_app_type
fabs
strcspn
??2@YAPAXI@Z
_set_error_mode
_mbcjistojms
_ismbclegal
memchr
_ismbcalnum
strftime
_CIfmod

msvcrt40

?sync_with_stdio@ios@@SAXXZ
rand
_fpclass
?sh_write@filebuf@@2HB
isleadbyte
strncmp
wscanf
??_Gbad_cast@@UAEPAXI@Z
_CIsin
?getline@istream@@QAEAAV1@PADHD@Z
srand
?osfx@ostream@@QAEXXZ
?set_unexpected@@YAP6AXXZP6AXXZ@Z
??0istream@@IAE@XZ
_adj_fdiv_r
??1stdiobuf@@UAE@XZ
_wfindnexti64
_hypot
?writepad@ostream@@AAEAAV1@PBD0@Z
??0bad_typeid@@QAE@PBD@Z
??_8ifstream@@7B@
_mbsdec
__RTtypeid
asctime
_mbsstr
?in_avail@streambuf@@QBEHXZ
?close@ifstream@@QAEXXZ
??4ostream@@IAEAAV0@PAVstreambuf@@@Z
?clear@ios@@QAEXH@Z
_expand
?write@ostream@@QAEAAV1@PBDH@Z
??_8strstream@@7Bistream@@@
freopen
_safe_fprem1
strcpy

mapi32

MNLS_lstrcpyW@8
WrapCompressedRTFStream
MAPIDeleteMail
ScCountNotifications@12
FreePadrlist@4
HrDecomposeEID@28
ChangeIdleRoutine@28
MAPILogoff
FPropContainsProp@12
HexFromBin@12
ScMAPIXFromSMAPI
UlPropSize@4
InstallFilterHook@4
ScCopyProps@16
DllGetClassObject
HrDispatchNotifications@4
ScInitMapiUtil@4
GetTnefStreamCodepage@12
cmc_query_configuration
FBadRglpszW@8
UNKOBJ_ScCOReallocate@12
BMAPIDetails
MAPIOpenLocalFormContainer@4
cmc_logon
ScRelocProps@20
MNLS_CompareStringW@24
BMAPISendMail
CreateTable@36
FBadProp@4
FtMulDwDw@8
OpenTnefStreamEx@32
MNLS_lstrcmpW@8
EnableIdleRoutine@8
BMAPIGetAddress
BMAPIGetReadMail
MAPIGetDefaultMalloc@0
cmc_list

setupapi

SetupQueueDeleteSectionW
SetupSetDirectoryIdW
CM_Get_Next_Log_Conf_Ex
CM_Request_Device_EjectW
CM_Unregister_Device_Interface_ExA
SetupDiRegisterCoDeviceInstallers
CM_Get_Device_Interface_Alias_ExW
SetupFreeSourceListA
MyFree
SetupSetFileQueueAlternatePlatformW
InstallHinfSectionA
SetupDiDeleteDeviceInterfaceData
CM_Set_HW_Prof_Flags_ExA
SetupDiGetHwProfileListExA
pSetupAddMiniIconToList
CM_Request_Eject_PC_Ex
CM_Get_DevNode_Custom_PropertyW
SetupQuerySpaceRequiredOnDriveA
SetupDiInstallDevice
SetupQueryInfFileInformationW
SetupDiSetClassRegistryPropertyA
pSetupGuidFromString
SetupGetBinaryField
SetupOpenInfFileA
CM_Is_Version_Available_Ex
pSetupConcatenatePaths
CM_Query_And_Remove_SubTree_ExW
SetupDuplicateDiskSpaceListA
CM_Get_Res_Des_Data_Size_Ex
SetupCommitFileQueue
SetupQueueRenameSectionW
SetupDiGetHwProfileFriendlyNameExW
SetupQueryInfOriginalFileInformationW
SetupDiDeleteDeviceInfo
SetupQueueDeleteA

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

77f8c204c89ede62d5f7c003238757b7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

msvcrt40

mapi32

setupapi

Sections

.text Size: 36KB - Virtual size: 36KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 1024B - Virtual size: 47KB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 36KB - Virtual size: 36KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 1024B - Virtual size: 47KB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 1KB - Virtual size: 1KB