4d342c90f8cf8463f2e3412bc2c82012_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4d342c90f8cf8463f2e3412bc2c82012_JaffaCakes118
Size

667KB
MD5

4d342c90f8cf8463f2e3412bc2c82012
SHA1

6b5e22b04ce4189f8c04ce43a07472ce33db1337
SHA256

0802362bdb41bf6c0ef2b7ce2b88cc51bd1c4950b049e718a3a9cf7e488f5368
SHA512

fb712806ab7ab6209da30cdc0f3b7ef11e0cd958713624aefb16c46c811e98bbe5903ec1540d269f1e35440a0f8832f94c17505185476854c642d182498b1775
SSDEEP

12288:U2JhG//t8C5VCFSoDpaQlHfl6mCiWDaBMFC9oCGsq:U2JC/t8iVNoDgQVN6mCiptIX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d342c90f8cf8463f2e3412bc2c82012_JaffaCakes118

Files

4d342c90f8cf8463f2e3412bc2c82012_JaffaCakes118
.exe windows:6 windows x86 arch:x86

beb5959bb1e83e2e3f4789da7e63bdcd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\DODO\Videos\TwoStageSearch\TwoStageSearch\TwoStageSearch\Release\TwoStageSearch.pdb

Imports

kernel32

Sleep
GetExitCodeProcess
ReadFile
CreateFileW
GetTempPathW
GetFileSizeEx
GetLastError
GetCurrentDirectoryW
GetProcAddress
VirtualAlloc
FindClose
SetCurrentDirectoryW
FindNextFileW
CloseHandle
DeleteFileW
FlushFileBuffers
GetFullPathNameA
WriteConsoleW
CreateProcessW
WaitForSingleObject
ReadConsoleW
SetEndOfFile
GetTimeZoneInformation
SetStdHandle
RtlUnwind
HeapReAlloc
OutputDebugStringW
LoadLibraryExW
FreeLibrary
SetConsoleCtrlHandler
SetFilePointerEx
GetConsoleMode
GetConsoleCP
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LoadLibraryW
GetStringTypeW
SetEnvironmentVariableW
LeaveCriticalSection
EnterCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
DeleteCriticalSection
RaiseException
GetFileAttributesExW
CreateSemaphoreW
GetTickCount
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
CreateEventW
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetFullPathNameW
PeekNamedPipe
GetFileType
GetFileInformationByHandle
FileTimeToLocalFileTime
HeapSize
GetModuleFileNameW
WriteFile
GetStdHandle
AreFileApisANSI
GetModuleHandleExW
ExitProcess
GetProcessHeap
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
GetModuleHandleW
GetLocaleInfoW
FindFirstFileExW
GetLogicalDriveStringsW
GetEnvironmentVariableW
GetCurrentThread
SetLastError
GetCPInfo
GetOEMCP
SetFilePointer
FindFirstFileW
CreateFileA
GetTempFileNameW
FatalAppExitA
GetACP
IsValidCodePage
GetCommandLineW
HeapFree
HeapAlloc
EncodePointer
DecodePointer
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
IsDebuggerPresent
IsProcessorFeaturePresent
SetEnvironmentVariableA

user32

EndPaint
ClientToScreen
DestroyWindow
GetWindowTextLengthW
TranslateAcceleratorW
ScreenToClient
GetWindowRect
SetActiveWindow
GetMessageW
SendInput
PostQuitMessage
SetKeyboardState
GetKeyState
GetSubMenu
GetFocus
DialogBoxParamW
GetParent
LoadCursorW
GetClipCursor
FindWindowW
GetClientRect
SetFocus
BeginPaint
wsprintfW
TranslateMessage
LoadAcceleratorsW
GetKeyboardState
GetMenu
RegisterClassExW
OffsetRect
GetAsyncKeyState
MessageBoxA
SetCursorPos
LoadMenuW
GetAncestor
GetWindowTextW
PeekMessageW
GetDlgItem
EndDialog
GetDesktopWindow
GetCursorPos
LoadStringW
EnumChildWindows
ShowWindow
SetMenu
GetSysColorBrush
LoadBitmapW
CreateDialogParamW
FindWindowExW
ClipCursor
CreateWindowExW
SetMenuDefaultItem
MessageBoxW
GetComboBoxInfo
GetSystemMetrics
IsWindowVisible
SendMessageW
UpdateWindow
GetDlgCtrlID
SetWindowTextW
DefWindowProcW
CopyRect
GetWindow
MoveWindow
DispatchMessageW
LoadIconW

gdi32

CreateFontW
DeleteObject

advapi32

CryptAcquireContextA

shell32

ShellExecuteW
SHOpenWithDialog
ShellExecuteExW

comctl32

ord413
ImageList_Add
ImageList_Create
ord410

shlwapi

ord191
PathMatchSpecW

Exports

Exports

T5676thdrgddhf

Sections

.text
Size: 385KB - Virtual size: 384KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

beb5959bb1e83e2e3f4789da7e63bdcd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

comctl32

shlwapi

Exports

Exports

Sections

.text Size: 385KB - Virtual size: 384KB

.rdata Size: 68KB - Virtual size: 68KB

.data Size: 9KB - Virtual size: 18KB

.rsrc Size: 184KB - Virtual size: 184KB

.reloc Size: 19KB - Virtual size: 18KB

.text
Size: 385KB - Virtual size: 384KB

.rdata
Size: 68KB - Virtual size: 68KB

.data
Size: 9KB - Virtual size: 18KB

.rsrc
Size: 184KB - Virtual size: 184KB

.reloc
Size: 19KB - Virtual size: 18KB