5e78544b70dd390f5f466139ddc68a25_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

5e78544b70dd390f5f466139ddc68a25_JaffaCakes118
Size

325KB
MD5

5e78544b70dd390f5f466139ddc68a25
SHA1

01a4782dbf535bc212d89d2f7e7f11c37b190e2f
SHA256

9eccc1413d42ebeef19ec598feee7641476afe08a3c371d405a31549e32f3edb
SHA512

c436f11bd1ae7e34f35f0fb2ab90f0b847b3783e444ce6344aece1d6889406bada528c032c984621d43548b075473484f963e3616b5348178008deafd23f9ed4
SSDEEP

6144:R9BrvDh5Tsg7q0ROWVjmh2CkYmLzERQc4tpV/pb7:R91vDhlNbbVjmnmLz+QcepV5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
5e78544b70dd390f5f466139ddc68a25_JaffaCakes118

Files

5e78544b70dd390f5f466139ddc68a25_JaffaCakes118
.exe windows:5 windows x86 arch:x86

d0b2dcfc422ebb56768b6cb7165f812b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

AnimateWindow

comdlg32

ChooseColorW
GetOpenFileNameW
GetSaveFileNameW
PrintDlgW

shell32

DragQueryFileW
DragQueryPoint
ShellExecuteW
SHGetPathFromIDListW
Shell_NotifyIconW
SHGetMalloc
DragFinish
SHGetSpecialFolderLocation
SHBrowseForFolderW

ole32

CoUninitialize
CoInitialize

advapi32

RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegCloseKey
RegEnumKeyExW
RegDeleteKeyW
IsTextUnicode
RegQueryInfoKeyW
RegOpenKeyExW

gdi32

SetBkMode
DeleteObject
Rectangle
CreatePen
GetStockObject
DeleteDC
GetROP2
GetTextExtentPoint32W
CreateSolidBrush
SetTextColor
GetPixel
CreateFontIndirectW
GetTextExtentPointW
GetDeviceCaps
DPtoLP
StartDocW
StartPage
SetTextAlign
SelectObject
EndPage
EndDoc
EnumFontFamiliesExW
CreateBitmap
CreatePatternBrush
SetBrushOrgEx
PatBlt
OffsetWindowOrgEx
SetWindowOrgEx
SetBkColor
CreateCompatibleDC
GetObjectW
CreateCompatibleBitmap
BitBlt
CreateFontW
SaveDC
RestoreDC
MoveToEx
LineTo
CreateHatchBrush
GetTextMetricsW
ExtTextOutW
SetROP2

comctl32

ImageList_EndDrag
InitCommonControlsEx
ImageList_BeginDrag
ImageList_AddMasked
ImageList_Destroy
ImageList_Create
ImageList_ReplaceIcon
_TrackMouseEvent
ImageList_GetImageInfo
ImageList_GetImageCount
ImageList_DragMove
ImageList_DragShowNolock
ImageList_DragEnter
ImageList_Draw
ImageList_Add
ImageList_SetIconSize

netapi32

NetConnectionEnum

shlwapi

PathRemoveExtensionW
PathFileExistsW
PathFindExtensionW
PathStripPathW
PathIsRelativeW
PathFindFileNameW
PathCompactPathExW
PathIsDirectoryW
PathMatchSpecW
PathRemoveFileSpecW
PathAppendW
PathAddExtensionW

kernel32

LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetFilePointer
ReadFile
HeapSize
RaiseException
RtlUnwind
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentProcessId
HeapFree
VirtualFree
HeapCreate
DeleteCriticalSection
CompareStringW
CompareStringA
GetDriveTypeA
SetEndOfFile
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetEnvironmentVariableA
GetLocaleInfoW
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoA
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapReAlloc
VirtualAlloc
WideCharToMultiByte
MultiByteToWideChar
lstrcmpW
lstrcatW
GetModuleFileNameW
lstrlenW
lstrcpyW
DeleteFileW
lstrcmpiW
GetLongPathNameW
GetFullPathNameW
MoveFileW
SetFileAttributesW
GetFileAttributesW
GlobalUnlock
GlobalLock
GetLastError
GetCurrentThreadId
GetModuleHandleW
SetCurrentDirectoryW
GetCurrentDirectoryW
FreeLibrary
GlobalFree
CloseHandle
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType

Sections

.text
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 340KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CODE
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 211KB - Virtual size: 211KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d0b2dcfc422ebb56768b6cb7165f812b

Headers

DLL Characteristics

File Characteristics

Imports

user32

comdlg32

shell32

ole32

advapi32

gdi32

comctl32

netapi32

shlwapi

kernel32

Sections

.text Size: 81KB - Virtual size: 80KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 13KB - Virtual size: 340KB

.CODE Size: 512B - Virtual size: 448B

.rsrc Size: 211KB - Virtual size: 211KB

.text
Size: 81KB - Virtual size: 80KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 13KB - Virtual size: 340KB

.CODE
Size: 512B - Virtual size: 448B

.rsrc
Size: 211KB - Virtual size: 211KB