JaffaCakes118_70ac5b74495a90287bc75716f82f5ff6

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_70ac5b74495a90287bc75716f82f5ff6
Size

721KB
MD5

70ac5b74495a90287bc75716f82f5ff6
SHA1

d0a457c527eb87de6304829e6f3b37c53afa6c2b
SHA256

c69d2912adefb602278cc23d8551c9f5f7821f3ae93e68a09560f20f0fdf7055
SHA512

2b24396dc4c7dd7e9535897b5fb928ca541e06c6d5d23731b426bbbf858e95d1f2de59371f378d3e4e31ddead72efd32abff0de795b5d55708047afe2f0c2cb9
SSDEEP

12288:7c6gCtpSDJOQXnYyOV16WXlED0kPYjUFMoyQOHQhBdo0HTwZGEX8cA0/M:TxpKO0Q6ClE9PYjUC5QTh0NsEv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_70ac5b74495a90287bc75716f82f5ff6

Files

JaffaCakes118_70ac5b74495a90287bc75716f82f5ff6
.exe windows:5 windows x86 arch:x86

95764cd3a93b27321012d20c57632d43

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\xajucodo 57\jajej\hoxoy j.pdb

Imports

kernel32

HeapAlloc
GetCurrentProcess
GetEnvironmentStringsW
SetEvent
FlushViewOfFile
SleepEx
ReadConsoleW
InitAtomTable
HeapDestroy
WriteConsoleW
GetModuleFileNameW
CreateActCtxA
DeactivateActCtx
GetProcAddress
BeginUpdateResourceW
GetAtomNameA
LocalAlloc
SetEnvironmentVariableA
GetOEMCP
CreateIoCompletionPort
SetConsoleTitleW
GetModuleHandleA
GetProcessShutdownParameters
EraseTape
VirtualProtect
GetCPInfoExA
Module32Next
ReleaseMutex
EndUpdateResourceA
GetVersionExA
FindNextVolumeA
lstrcpyW
LCMapStringW
SetLastError
SetProcessAffinityMask
IsProcessorFeaturePresent
HeapReAlloc
EncodePointer
DecodePointer
GetModuleHandleW
ExitProcess
GetCommandLineW
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
GetLastError
InterlockedDecrement
ReadFile
HeapFree
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
SetFilePointer
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
IsValidCodePage
CloseHandle
LoadLibraryW
WriteFile
FreeEnvironmentStringsW
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
Sleep
MultiByteToWideChar
SetStdHandle
RtlUnwind
FlushFileBuffers
GetStringTypeW
HeapSize
RaiseException
CreateFileW

user32

ClientToScreen

gdi32

GetBitmapBits

winhttp

WinHttpSetOption

Sections

.text
Size: 546KB - Virtual size: 546KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 42.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fulax
Size: 1024B - Virtual size: 626B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.jetaro
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 148KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

95764cd3a93b27321012d20c57632d43

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

winhttp

Sections

.text Size: 546KB - Virtual size: 546KB

.rdata Size: 17KB - Virtual size: 17KB

.data Size: 6KB - Virtual size: 42.8MB

.fulax Size: 1024B - Virtual size: 626B

.jetaro Size: 1024B - Virtual size: 624B

.rsrc Size: 148KB - Virtual size: 148KB

.text
Size: 546KB - Virtual size: 546KB

.rdata
Size: 17KB - Virtual size: 17KB

.data
Size: 6KB - Virtual size: 42.8MB

.fulax
Size: 1024B - Virtual size: 626B

.jetaro
Size: 1024B - Virtual size: 624B

.rsrc
Size: 148KB - Virtual size: 148KB