54af8a3e9e433a4c4495d79eb5a01350_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

54af8a3e9e433a4c4495d79eb5a01350_JaffaCakes118
Size

86KB
MD5

54af8a3e9e433a4c4495d79eb5a01350
SHA1

e766274976d3e5cae7599e3ffec46b271f76e48c
SHA256

f5025c49b275dec310e79e1e672dd47e988e669f35a3906ec7599817877a3671
SHA512

cbac11e2324573d2f39ee323917f9533ba77e30dd6847ea18d359d0d32fd79e701b6b27437a3d16a6b13cc3e5d5a93cf38a7d4ee541088c11c2baa63812ba3b9
SSDEEP

1536:N3uoTwevQsLfCKx6obTi8rYbztI+gPRc2GV3M/bHUFBF:N3uVDsjLx6oC+2FxM/bHUx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
54af8a3e9e433a4c4495d79eb5a01350_JaffaCakes118

Files

54af8a3e9e433a4c4495d79eb5a01350_JaffaCakes118
.exe windows:4 windows x86 arch:x86

241e0921c48e71dd5105647d744594a0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VerLanguageNameA
CompareStringA
GetLocaleInfoA
HeapAlloc
LocalFlags
IsValidCodePage
HeapLock
VirtualQueryEx
GetNumberFormatA
LeaveCriticalSection
VirtualQuery
HeapCreate
LocalFree
OpenMutexA
GetDateFormatA
LocalHandle
GetModuleHandleA
GetProcAddress
GetComputerNameA
CopyFileA
SuspendThread
GetModuleFileNameA
GetStartupInfoA
ReleaseSemaphore
GetCurrentProcess
GetExitCodeThread
CreateSemaphoreA
VirtualAlloc
PulseEvent
GetCommandLineA
GetHandleInformation
GetEnvironmentVariableA
GetVersion
ExitProcess
EnterCriticalSection
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetLastError
SetFilePointer
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
HeapDestroy
VirtualFree
HeapFree
RtlUnwind
WriteFile
InitializeCriticalSection
SetStdHandle
FlushFileBuffers
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetACP
GetOEMCP
HeapReAlloc
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
CloseHandle

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerFindFileA
VerInstallFileA
VerQueryValueA

avifil32

AVIFileCreateStreamW
AVIBuildFilterA
AVIFileInfoA
AVIFileRelease
AVIStreamGetFrameClose
AVIFileCreateStreamA
AVIStreamEndStreaming
EditStreamSetNameW
AVIFileReadData
AVIFileOpenA
AVIGetFromClipboard

msvfw32

DrawDibTime
DrawDibOpen
ord2

uxtheme

GetThemeSysColorBrush

ws2_32

select
gethostname
socket
send
getprotobyname
ntohs
shutdown
accept

wsnmp32

ord205
ord200
ord904
ord100
ord502
ord107
ord901

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

241e0921c48e71dd5105647d744594a0

Headers

File Characteristics

Imports

kernel32

version

avifil32

msvfw32

uxtheme

ws2_32

wsnmp32

Sections

.text Size: 27KB - Virtual size: 27KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 3KB - Virtual size: 14KB

.rsrc Size: 43KB - Virtual size: 42KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 27KB - Virtual size: 27KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 3KB - Virtual size: 14KB

.rsrc
Size: 43KB - Virtual size: 42KB

.reloc
Size: 4KB - Virtual size: 3KB