cbbfe74029e6eb81ccc66d728428b328_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

cbbfe74029e6eb81ccc66d728428b328_JaffaCakes118
Size

596KB
MD5

cbbfe74029e6eb81ccc66d728428b328
SHA1

75ca75a839b5605286385329839d01986b11b19d
SHA256

e40c1359fa0e86c65f50363b88e29a7d4d24990195cc766273203c496393ebe4
SHA512

9a8e97265e9a777c8d5e7b9508c444b574a58dad184c6b008ecda3106926e9c0eed15d11c220282054d70d7a61afceb308c4d4c6ed611a0c0a516e5f4aef1c12
SSDEEP

12288:bGTJt5et/HePSr9fg/YiTRtILP8IQXbcZ9uDWUJLypTJ4JLvC5:mJfet/He6r9fUHmPpQAWSqkWLv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cbbfe74029e6eb81ccc66d728428b328_JaffaCakes118

Files

cbbfe74029e6eb81ccc66d728428b328_JaffaCakes118
.exe windows:5 windows x86 arch:x86

97856e36aca27ff13ae687d21f9f6f5c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\sucumu jis\mofozemotodef sapazikuhebike.pdb

Imports

kernel32

lstrlenA
WriteConsoleOutputCharacterA
LocalCompact
MoveFileExW
InterlockedDecrement
GetCurrentProcess
GetSystemWindowsDirectoryW
GetUserDefaultLCID
WriteConsoleInputA
SetEvent
GetSystemDefaultLCID
IsBadReadPtr
GetConsoleAliasesLengthA
ReadConsoleOutputA
InitializeCriticalSection
GetVolumePathNameW
FindResourceExA
GetConsoleCP
GlobalAlloc
InterlockedPopEntrySList
LeaveCriticalSection
DnsHostnameToComputerNameW
lstrcpynW
GetConsoleAliasW
SetConsoleCursorPosition
GetFileAttributesW
VerifyVersionInfoA
WriteConsoleW
ReadFile
CreateActCtxA
GetComputerNameA
VerifyVersionInfoW
GetCPInfoExW
GetLastError
GetProcAddress
PeekConsoleInputW
EnumDateFormatsExA
GlobalGetAtomNameA
DeleteTimerQueue
GlobalGetAtomNameW
WaitForMultipleObjects
SetSystemTime
SetEnvironmentVariableA
SetConsoleTitleW
GetModuleHandleA
lstrcatW
UpdateResourceW
EraseTape
GetConsoleTitleW
BuildCommDCBA
VirtualProtect
SetCalendarInfoA
FindFirstVolumeA
EndUpdateResourceA
ReadConsoleInputW
GetPrivateProfileSectionW
AreFileApisANSI
GetACP
GetSystemDefaultLangID
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapReAlloc
HeapAlloc
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TerminateProcess
IsDebuggerPresent
HeapFree
DeleteCriticalSection
EnterCriticalSection
HeapCreate
VirtualFree
VirtualAlloc
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapSize
GetCPInfo
GetOEMCP
IsValidCodePage
GetLocaleInfoA
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW

user32

GetAltTabInfoW
RealGetWindowClassA

advapi32

BackupEventLogA

Exports

Exports

@GetOtherVice@12

Sections

.text
Size: 464KB - Virtual size: 463KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 40.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

97856e36aca27ff13ae687d21f9f6f5c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 464KB - Virtual size: 463KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 17KB - Virtual size: 40.2MB

.rsrc Size: 96KB - Virtual size: 96KB

.text
Size: 464KB - Virtual size: 463KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 17KB - Virtual size: 40.2MB

.rsrc
Size: 96KB - Virtual size: 96KB