ffbb1d9b99847215c722b2a49e5c480a_JaffaCakes118

General

Target

ffbb1d9b99847215c722b2a49e5c480a_JaffaCakes118
Size

948KB
MD5

ffbb1d9b99847215c722b2a49e5c480a
SHA1

c3098190d5bb6b25c2d2098c6f3bd70b9f7bf086
SHA256

3dfa4850be5dd2f847172c8c0bb9254c30d15fce1574dccf335c73d9b1e70ff8
SHA512

b88eaf30bea266f2f8f328d566639c1943449a23d498751601a1d93e73be03120f16a9f7c0b292b64d64dbcc8b8c9b5b5d27eb5339cb94e25910c529a8ffa13b
SSDEEP

24576:pYsM6dAKlKll8bluxATJPhhu2MrJV/qE2npRD5DcIkiUK:VtAKlKnVATl/duqhnVAK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffbb1d9b99847215c722b2a49e5c480a_JaffaCakes118

Files

ffbb1d9b99847215c722b2a49e5c480a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d3a2da4a605391ed2eb0ffccc678226c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegSetValueW
RegOpenKeyW

user32

UnhookWindowsHookEx
GetParent
DeferWindowPos
HideCaret
BeginPaint
DrawFocusRect
WaitForInputIdle
RegisterClipboardFormatW
GetCapture
GetScrollInfo
DefMDIChildProcW
GetDlgItem
GetWindowTextW
IsWindow
TrackPopupMenu
ShowWindow
GetClassNameW
CallNextHookEx
AppendMenuW
ChangeDisplaySettingsW
PostMessageW
LoadImageW
ReleaseCapture
TranslateMDISysAccel
AdjustWindowRectEx
GetSystemMetrics
SetWindowRgn

kernel32

MultiByteToWideChar
GetProcAddress
LoadLibraryA
VirtualAlloc
GetOEMCP
HeapReAlloc
GetStringTypeA
LCMapStringA
LCMapStringW
InterlockedDecrement
GetStringTypeW
InterlockedIncrement
HeapDestroy
GetEnvironmentVariableA
GetVersionExA
GetLastError
GetModuleHandleA
TlsAlloc
GetCurrentThreadId
GetStartupInfoA
SetLastError
TlsGetValue
InitializeCriticalSection
RtlUnwind
WriteFile
VirtualFree
HeapCreate
HeapFree
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
HeapAlloc
GetACP
GetFileType
SetHandleCount
GetStdHandle
GetEnvironmentStrings
WideCharToMultiByte
GetEnvironmentStringsW
UnhandledExceptionFilter
ExitProcess
GetCurrentProcess
FreeEnvironmentStringsA
GetModuleFileNameA
FreeEnvironmentStringsW
GetVersion
TerminateProcess
GetCommandLineA
MapViewOfFile
CreateFileA
TlsSetValue
CreateFileMappingW

Sections

.text
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 613KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d3a2da4a605391ed2eb0ffccc678226c

Headers

File Characteristics

Imports

advapi32

user32

kernel32

Sections

.text Size: 36KB - Virtual size: 32KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 12KB - Virtual size: 613KB

.rsrc Size: 8KB - Virtual size: 4KB

.text
Size: 36KB - Virtual size: 32KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 613KB

.rsrc
Size: 8KB - Virtual size: 4KB