ff1a1ea9903b56889577560b8fc1ff47_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ff1a1ea9903b56889577560b8fc1ff47_JaffaCakes118
Size

159KB
MD5

ff1a1ea9903b56889577560b8fc1ff47
SHA1

c47d1615f3658865737469bc34f49aac4255b934
SHA256

b888d34b428db2e2ac860409024f5a4121c6e273119d643bac345970b8d19c7f
SHA512

58d5d46492643b34aa016fa59dfebb1a5eb113ba490d1001553e57b85d0179a471baabf6d05400debef5f50ee63fca7123aba8842d146059ca62dd2a55632fbf
SSDEEP

3072:dzd7kNBMFIZm3xCorZTC22i+yUvmqyPOwPzp51Dg+yn4cWIeAW7vlyy:dazMWZkCowiwVmPBDg3n4cWx3v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff1a1ea9903b56889577560b8fc1ff47_JaffaCakes118

Files

ff1a1ea9903b56889577560b8fc1ff47_JaffaCakes118
.exe windows:5 windows x86 arch:x86

5a23fa4160c729e11052f7f7b54c9577

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msi

ord65

user32

GetWindowDC
GetDesktopWindow
GetWindowTextLengthA
AnyPopup
CloseWindow
ReleaseDC

kernel32

EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsDebuggerPresent
GetTickCount
GetEnvironmentStrings
GetUserDefaultLCID
GetCommandLineA
GetPriorityClass
GetProcAddress
GetModuleHandleA
GetCurrentThread
GetStdHandle
GetTimeZoneInformation
GetLocaleInfoW
CompareStringA
CompareStringW
VirtualAlloc
TlsAlloc
GetStartupInfoA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
SetEnvironmentVariableA
TlsFree
SetLastError
TlsGetValue
GetLastError
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
HeapReAlloc
IsBadWritePtr
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
Sleep
IsValidLocale

gdi32

GetRasterizerCaps
AbortDoc
GetTextMetricsA
SetTextAlign
GetTextColor

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 111KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5a23fa4160c729e11052f7f7b54c9577

Headers

DLL Characteristics

File Characteristics

Imports

msi

user32

kernel32

gdi32

Sections

.text Size: 40KB - Virtual size: 40KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 111KB - Virtual size: 198KB

.rsrc Size: 1024B - Virtual size: 600B

.text
Size: 40KB - Virtual size: 40KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 111KB - Virtual size: 198KB

.rsrc
Size: 1024B - Virtual size: 600B