0943b1dca13811536bdc6be836466ce7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0943b1dca13811536bdc6be836466ce7_JaffaCakes118
Size

46KB
MD5

0943b1dca13811536bdc6be836466ce7
SHA1

40fbe8ac58c24424c70339bdaed0b6be8674ee84
SHA256

a45c566cb7929c590ca8a61d8ed6798c80724aae25ab26bd53a5d718759b7bc2
SHA512

b85526c741ed4d7dba6011cbaa7c752d9ebfd9c62686fdea4250c7bcd396a37e167bb7907a163282ffe1a6b606533e7ae250a84c37c256f4b2839c67948d4371
SSDEEP

768:nJ5gSeFWkQiPtcYH4oigVbinvvfzgZwpBYqvVAk/vfUDKqBGucADay+THjZHv4TR:nJ6SMtHh/Vmn/EKPVAkHZqBGr0OZPseE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Label_Copy_UPS.exe

Files

0943b1dca13811536bdc6be836466ce7_JaffaCakes118
.zip
Label_Copy_UPS.exe
.exe windows:5 windows x86 arch:x86

412a4f7c304d5406058a8761b6237b0f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

IsCharAlphaA
DialogBoxParamA
EnumWindows
SetWindowTextA
SetWindowTextW
GetWindowThreadProcessId
SetDlgItemTextW
GetActiveWindow

ole32

CoRevokeClassObject

comctl32

InitCommonControlsEx

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

kernel32

SetFileAttributesA
InitializeCriticalSection
GetTickCount
LocalAlloc
HeapDestroy
GetDateFormatA
DeleteCriticalSection
LoadResource
FindResourceA
GetNumberOfConsoleMouseButtons
LoadLibraryA
FreeLibrary
GetProcAddress
IsBadReadPtr
LocalFree
GetStartupInfoA
GetModuleHandleA
HeapCreate
IsValidLanguageGroup

Sections

.text
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ