b4ba837fd3c4e6107785ee58dbd7ea4a_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

b4ba837fd3c4e6107785ee58dbd7ea4a_JaffaCakes118
Size

101KB
MD5

b4ba837fd3c4e6107785ee58dbd7ea4a
SHA1

16189bbb41a3929d945973aefd4f19d1d8996d18
SHA256

37775a058717f11e1a08aa691bdbd9cd1a938e340ae3951d0e7a2ff502e383fb
SHA512

649ed9bcea84a268aeb6a880568bbd68c4ac5131126cb9fd6b62d8c08b87d1b5dc8c21a85e81a79e99ace2c14ced50d0d2d83efc05f90c689afb98cd72c57995
SSDEEP

1536:se8QKD1ERvaS9fjh7W4dlayVtTSaWgbQo/ERFjZsHLXw9vEjY/C+J56doXXPGYRq:/rlaS93lzVgabbX/EFsEtq+J1X/9RzG9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/b26f771a5e7d1a74849d7003408d33c6

Files

b4ba837fd3c4e6107785ee58dbd7ea4a_JaffaCakes118
.zip

Password: infected
b26f771a5e7d1a74849d7003408d33c6
.exe windows:4 windows x86 arch:x86

f616bff8db592b213b30000cfc159c86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegEnumKeyExA
RegDeleteValueW
RegCreateKeyExA
RegSetValueExW
OpenProcessToken
CryptAcquireContextA
RegDeleteKeyA
RegQueryValueExA
RegEnumValueA
EqualSid
GetLengthSid
RegCreateKeyExW
CryptDestroyHash
RegEnumValueW
RegDeleteKeyW
RegOpenKeyExW
RegOpenKeyExA
RegQueryValueExW

user32

ClientToScreen
GetMenuStringW
SendMessageW
GetMenuItemCount
DefWindowProcW
ReleaseDC
GetActiveWindow
MessageBeep
SetWindowLongW
GetMenu
DestroyWindow
SetActiveWindow
PtInRect
SetTimer
SetWindowTextW
DestroyIcon
PostMessageW
OffsetRect
GetClientRect
CreateWindowExW
UnregisterClassA
MoveWindow
SetCapture
DrawFocusRect
ShowWindowAsync
LoadIconA
InflateRect
ChangeClipboardChain

kernel32

GetOEMCP
GetACP
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetCPInfo
LCMapStringW
LCMapStringA
WideCharToMultiByte
Sleep
GetStringTypeW
GetStringTypeA
SetConsoleCtrlHandler
HeapReAlloc
FatalAppExitA
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
HeapAlloc
IsBadCodePtr
IsBadWritePtr
IsBadReadPtr
SetUnhandledExceptionFilter
VirtualAlloc
GetProcAddress
LoadLibraryA
GetLastError
DeleteCriticalSection
GetModuleHandleW
GetVersionExW
ExitProcess
InterlockedExchange
TerminateProcess
FreeLibrary
RtlUnwind
GetModuleHandleA
GetStartupInfoW
GetVersion
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentStrings
GetCommandLineW
GetCommandLineA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InterlockedDecrement
InterlockedIncrement
SetEnvironmentVariableA

Sections

.text
Size: 136KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

f616bff8db592b213b30000cfc159c86

Headers

File Characteristics

Imports

advapi32

user32

kernel32

Sections

.text Size: 136KB - Virtual size: 133KB

.data Size: 20KB - Virtual size: 18KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 136KB - Virtual size: 133KB

.data
Size: 20KB - Virtual size: 18KB

.rsrc
Size: 4KB - Virtual size: 1KB