0b4e6a34bc0a016932051634d36dd6df_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0b4e6a34bc0a016932051634d36dd6df_JaffaCakes118
Size

245KB
MD5

0b4e6a34bc0a016932051634d36dd6df
SHA1

ce933d55fadccf994262f5faf80c7f8f4f02edcf
SHA256

eca25743256746bca3addab7959cd1897407728558e761fda13c02d7af20a612
SHA512

581618ea1238569084f6c1d97f72fd6e7e3d5bbe3375b829643b1061a93c771e35eefec1f1a5f380a1d9f8d810c23b1c19a2b5d444577be538a5d36097d7e306
SSDEEP

6144:Kc9HKKwd4b4uBOgtq3MvadsRISwg1/t28EXYf/0m7iapLZINJfxRf:N9qelQgeMvaEpL/nEXWLpVIR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b4e6a34bc0a016932051634d36dd6df_JaffaCakes118

Files

0b4e6a34bc0a016932051634d36dd6df_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f84e48205f2b4dfb6232ba7cecce70fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

atl

ord45
ord57
ord30
ord32

gdi32

DeleteObject
DeleteDC
CreateCompatibleDC
SelectObject
CreateSolidBrush
CreateCompatibleBitmap

msvcrt

__setusermatherr
wcsstr
??3@YAXPAX@Z
_c_exit
??2@YAPAXI@Z
_controlfp
?terminate@@YAXXZ
_itow
_XcptFilter
_adjust_fdiv
__p__fmode
malloc
_CIpow
_beginthreadex
fputws
_wcsicmp
_wcmdln
__CxxFrameHandler
__dllonexit
wcstol
wcscmp
swscanf
_initterm

ole32

CoInitializeSecurity
CoCreateInstance

setupapi

SetupDiOpenDevRegKey
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo

user32

SystemParametersInfoW
FillRect
RegisterDeviceNotificationW
GetMonitorInfoW
GetPropW
GetDC
CloseDesktop
ClientToScreen
PtInRect
RegisterWindowMessageW
InflateRect
DispatchMessageW
DrawIconEx
DestroyWindow
ShowWindow
GetUserObjectInformationW
GetAncestor
CharNextW
IsWindow
SetThreadDesktop
PostMessageW

kernel32

QueryPerformanceCounter
WaitForMultipleObjectsEx
QueueUserAPC
GetTickCount
CloseHandle
GetProcessHeap
HeapAlloc
ReleaseMutex
FreeLibrary
GlobalAddAtomW
CancelIo
EnterCriticalSection
DuplicateHandle
CreateFileW
CreateFileMappingW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetThreadPriority
CancelWaitableTimer
LoadLibraryW
GetCurrentThreadId
VirtualFree
GetModuleHandleA
ReadFile
VirtualAlloc
SetThreadExecutionState
SetProcessShutdownParameters
GetStdHandle
InitializeCriticalSection
CreateWaitableTimerW
GetOverlappedResult

advapi32

OpenThreadToken
SetSecurityDescriptorGroup
RegQueryValueExA
SetSecurityDescriptorOwner
GetLengthSid
RegSetValueExW
InitializeSecurityDescriptor
RegSetValueW

hid

HidP_GetSpecificButtonCaps
HidP_GetSpecificValueCaps
HidD_FreePreparsedData
HidP_GetUsages

Sections

.text
Size: 209KB - Virtual size: 209KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 560KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f84e48205f2b4dfb6232ba7cecce70fc

Headers

DLL Characteristics

File Characteristics

Imports

atl

gdi32

msvcrt

ole32

setupapi

user32

kernel32

advapi32

hid

Sections

.text Size: 209KB - Virtual size: 209KB

.data Size: 32KB - Virtual size: 31KB

.rsrc Size: 3KB - Virtual size: 560KB

.text
Size: 209KB - Virtual size: 209KB

.data
Size: 32KB - Virtual size: 31KB

.rsrc
Size: 3KB - Virtual size: 560KB