0a2e961848f91da8118f46a50b65e7cc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0a2e961848f91da8118f46a50b65e7cc_JaffaCakes118
Size

91KB
MD5

0a2e961848f91da8118f46a50b65e7cc
SHA1

5f3127add086b8456c45208e12b64c1a067e4526
SHA256

1d531620bfbb9cbfa60310ac4b8bd69486179217accc78c31e4c64ffc20f6b11
SHA512

e8b9f780c1b94439002301681bbd1a8c4404c56e1f5322e99f01e3321ad946424452625405f429a5cc0e190af5c82e253500ec2505a1828c12f9fc7c5f22487c
SSDEEP

1536:EgO01naIw46r5Sf5jvqoWcUaM0Es2k6M0DJJFc:EgO01n+4Bf5bNWcbGnM8Ja

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a2e961848f91da8118f46a50b65e7cc_JaffaCakes118

Files

0a2e961848f91da8118f46a50b65e7cc_JaffaCakes118
.exe windows:5 windows x86 arch:x86

94a7b8136f5447a631d73aa145195d8c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
ExitProcess
HeapReAlloc
LCMapStringA
WideCharToMultiByte
LCMapStringW
LoadLibraryA
GetWindowsDirectoryW
VirtualProtect
GetSystemInfo
VirtualQuery
GetLocaleInfoA
GetCPInfo
GetStringTypeA
GetStringTypeW
RtlUnwind
SetStdHandle
FlushFileBuffers
CloseHandle
HeapAlloc
HeapFree
GetVersionExA
GetStartupInfoW
GetModuleHandleA
GetCommandLineW
VirtualAlloc
GetLastError
GetUserDefaultUILanguage
SetFilePointer
SetCurrentDirectoryW

gdi32

CreateFontIndirectW
DeleteObject
CreateCompatibleDC
SelectObject
GetTextMetricsW
DeleteDC
GetObjectW

user32

DialogBoxParamW
SendDlgItemMessageA
SetClassLongA
mouse_event
IsDlgButtonChecked
EndDialog
SetForegroundWindow
AllowForegroundActivation
SetWindowPos
SetWindowLongW
GetWindowLongW
GetDlgItem
SendDlgItemMessageW
PostQuitMessage
LoadStringW
SendMessageW
LoadIconW
EnableWindow
SetWindowTextW
SetDlgItemTextW
LoadIconA

comctl32

ord17

shell32

CommandLineToArgvW
ShellExecuteW

shlwapi

UrlEscapeW
UrlUnescapeW

ntdll

RtlFreeHeap
RtlQueryEnvironmentVariable_U
NtMapViewOfSection
NtCreateSection
NtUnmapViewOfSection
NtProtectVirtualMemory
NtAllocateVirtualMemory
NtFreeVirtualMemory
NtQuerySystemInformation
NtQueryVirtualMemory
NtQueryInformationFile
RtlDoesFileExists_U
RtlUnicodeStringToInteger
RtlAllocateHeap
RtlExpandEnvironmentStrings_U
RtlAppendUnicodeStringToString
RtlStringFromGUID
NtQueryAttributesFile
NtQueryInformationProcess
RtlFormatCurrentUserKeyPath
NtCreateKey
NtSetValueKey
DbgPrint
strchr
isdigit
strspn
_vsnprintf
sprintf
RtlUpcaseUnicodeToMultiByteN
NtWriteFile
RtlAppendUnicodeToString
NtDeleteFile
NtOpenKey
NtQueryValueKey
NtClose
RtlDosPathNameToNtPathName_U
NtCreateFile
qsort
RtlCreateUnicodeString
RtlFreeUnicodeString
RtlInitUnicodeString
RtlGUIDFromString

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

94a7b8136f5447a631d73aa145195d8c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

gdi32

user32

comctl32

shell32

shlwapi

ntdll

Sections

.text Size: 50KB - Virtual size: 50KB

.data Size: 4KB - Virtual size: 9KB

.rsrc Size: 39KB - Virtual size: 52KB

.text
Size: 50KB - Virtual size: 50KB

.data
Size: 4KB - Virtual size: 9KB

.rsrc
Size: 39KB - Virtual size: 52KB