JaffaCakes118_e36181ec4a214dfbdc1cd514a1d6353f8263e324d0fea11b32e418dbade93611

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_e36181ec4a214dfbdc1cd514a1d6353f8263e324d0fea11b32e418dbade93611
Size

237KB
MD5

ef84638c8b10bdeb72b76b172d86017e
SHA1

fa431904e332addf8b212699789dfc03ca561ba2
SHA256

e36181ec4a214dfbdc1cd514a1d6353f8263e324d0fea11b32e418dbade93611
SHA512

af0c2760d4144941472d3ef9bdeb666df53346592aa0c5f62bb2b87f09d39d7cec4a41c1fe5887c8eb023bba14f0abcb2fdb4fc29f0d1305e30157cd01bc086d
SSDEEP

6144:UKBEkd/dgcJxNwXfzdwPlMjFHrfrpRcmGRiJhtdsW:UTvcfevBwNMjBjrfGRedsW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/4a9101eedac349f9363fa76025195945ec79c6c6.bin

Files

JaffaCakes118_e36181ec4a214dfbdc1cd514a1d6353f8263e324d0fea11b32e418dbade93611
.zip

Password: infected
4a9101eedac349f9363fa76025195945ec79c6c6.bin
.dll windows:4 windows x86 arch:x86

16d0d53ca753562f7c584ee414def4f9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\155\human-River\Value\cover\In.pdb

Imports

kernel32

RemoveDirectoryW
VirtualProtect
TlsAlloc
GetWindowsDirectoryW
GetSystemTime
GetVolumeInformationW
GetCurrentDirectoryW
LCMapStringW
LCMapStringA
GetStringTypeW
GetTempPathW
CreateFileW
GetModuleFileNameW
OpenProcess
GetVersionExW
GetModuleHandleW
QueryPerformanceCounter
LoadResource
FindResourceW
TlsGetValue
FindFirstChangeNotificationW
GetDateFormatW
GetStringTypeA
GetLocaleInfoA
MultiByteToWideChar
GetOEMCP
GetACP
GetCPInfo
HeapSize
HeapAlloc
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
GetProcessHeap
RaiseException
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSection
LoadLibraryA

ole32

CoInitialize
CoRegisterClassObject
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize

comdlg32

GetOpenFileNameW
GetFileTitleW
GetSaveFileNameW
ChooseFontW

comctl32

CreateStatusWindowW
ord17
ImageList_SetOverlayImage
DestroyPropertySheetPage
ImageList_Add
ImageList_LoadImageW
CreateToolbarEx

msimg32

AlphaBlend
GradientFill
TransparentBlt

tapi32

lineInitialize
lineTranslateAddressW
lineAccept
lineClose
lineTranslateDialogW
lineRedirectW
lineOpenW
lineShutdown
lineHold

Exports

Exports

Childbetween
Drawflat
Littlemethod
Musicnose
RadioCompany
Replyenter
Surewall
Wish

Sections

.text
Size: 232KB - Virtual size: 229KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

16d0d53ca753562f7c584ee414def4f9

Headers

File Characteristics

PDB Paths

Imports

kernel32

ole32

comdlg32

comctl32

msimg32

tapi32

Exports

Exports

Sections

.text Size: 232KB - Virtual size: 229KB

.rdata Size: 96KB - Virtual size: 94KB

.data Size: 4KB - Virtual size: 87KB

.rsrc Size: 4KB - Virtual size: 792B

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 232KB - Virtual size: 229KB

.rdata
Size: 96KB - Virtual size: 94KB

.data
Size: 4KB - Virtual size: 87KB

.rsrc
Size: 4KB - Virtual size: 792B

.reloc
Size: 8KB - Virtual size: 7KB