5524511b34816ee595b195eebe2495bb_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

5524511b34816ee595b195eebe2495bb_JaffaCakes118
Size

477KB
MD5

5524511b34816ee595b195eebe2495bb
SHA1

4addb2bde53dbb7a04b2e136c3d93cf75f36adaf
SHA256

63bd217be3952557996bc345d669c76d83a8e1af58dab83ec6365ecfacd3d469
SHA512

01ec817cbbcf0428a8dd44e838ab506eafe9eeacc44dfd65b8b225156baaf58980cc46bad06552ad309369a1f29fe302eef59cb70bf60e9519e8e74230bb82ef
SSDEEP

6144:VTphC6SMy1ioBj48nVyjfJ68TBaKD1YUSxy7fMP5oKB3DS1bD:JC6SMOLFEx/TBaKWw1bD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
5524511b34816ee595b195eebe2495bb_JaffaCakes118

Files

5524511b34816ee595b195eebe2495bb_JaffaCakes118
.exe windows:5 windows x86 arch:x86

65c7f3c584f86005fcc52e67f4371b32

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

herklLEGHKWR#;3kl.pdb

Imports

oleaut32

GetActiveObject
VarBoolFromStr

setupapi

SetupDefaultQueueCallbackW
SetupDiGetDeviceRegistryPropertyA

advapi32

LockServiceDatabase
CryptSetProvParam
QueryUsersOnEncryptedFile

rpcrt4

RpcNetworkIsProtseqValidA
RpcStringFreeA

iphlpapi

CreateIpForwardEntry

ws2_32

recv

user32

DlgDirListComboBoxA
RealGetWindowClassA
GetDesktopWindow
LookupIconIdFromDirectoryEx
SubtractRect
UnloadKeyboardLayout
GetWindowThreadProcessId
SendMessageA
CreateWindowExW
GetInputState

kernel32

FreeEnvironmentStringsW
OpenFile
DeleteTimerQueueTimer
GetTimeZoneInformation
SetFileAttributesA
GetModuleHandleA
IsBadWritePtr
lstrcatW

opengl32

glEvalMesh2
glGetString

shell32

ShellExecuteW

gdi32

GetTextFaceA

wininet

InternetSetOptionA

msacm32

acmStreamPrepareHeader

winmm

waveOutSetPitch

crypt32

CertCreateCertificateChainEngine
CryptSIPRemoveProvider

Sections

.text
Size: 129KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 176KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 145KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

65c7f3c584f86005fcc52e67f4371b32

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

oleaut32

setupapi

advapi32

rpcrt4

iphlpapi

ws2_32

user32

kernel32

opengl32

shell32

gdi32

wininet

msacm32

winmm

crypt32

Sections

.text Size: 129KB - Virtual size: 128KB

.data Size: 176KB - Virtual size: 180KB

.idata Size: 145KB - Virtual size: 144KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 24KB - Virtual size: 23KB

.text
Size: 129KB - Virtual size: 128KB

.data
Size: 176KB - Virtual size: 180KB

.idata
Size: 145KB - Virtual size: 144KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 24KB - Virtual size: 23KB