0dc4cdae7d70a2c56474d9ed0172b5ec_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0dc4cdae7d70a2c56474d9ed0172b5ec_JaffaCakes118
Size

404KB
MD5

0dc4cdae7d70a2c56474d9ed0172b5ec
SHA1

5240e3b993f774a3671e6628501b6bc070aed322
SHA256

1bc75c18b2cce2fe3829a27ec686a32c2114ab056fc70217cf90fcb8338a92f4
SHA512

452167319a6617125a2f172a99cff02a3adcec43330b6936919ed59c2eb15ee304c7091d161940bbae9d15eab12a27e60a4938596e4fe0d0f27a69136d8c4920
SSDEEP

12288:R+5AnFmJ/ZY1lJXWY3fmXKUazBvmJCJiqk1:RRM/YjGHaUa1uJYJk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0dc4cdae7d70a2c56474d9ed0172b5ec_JaffaCakes118

Files

0dc4cdae7d70a2c56474d9ed0172b5ec_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d128dc9ea5cce5accefa70ca213b502f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathRemoveFileSpecW
PathRenameExtensionW
PathAddBackslashW
PathIsDirectoryW
PathIsRelativeW
PathCombineW
PathRemoveBackslashW
PathAppendW
PathFileExistsW

user32

CreatePopupMenu
SetCursor
SetParent
CloseClipboard
DestroyMenu
UpdateWindow
EmptyClipboard
ClientToScreen
SetRectEmpty
ReleaseDC
GetDesktopWindow
GetParent
GetWindowRect
EnumWindowStationsW
TranslateMessage
ClipCursor
LoadCursorW
InvalidateRect
UnionRect
ReleaseCapture
SetClipboardData
GetFocus
SetWindowPos
RedrawWindow
CopyRect
GetClientRect
GetKeyState
GetDC
EnableWindow
IsWindow
IsRectEmpty
EqualRect
SetRect
OpenClipboard
TrackPopupMenuEx
FillRect
GetClipboardData
PtInRect
SendMessageW
wsprintfW
OffsetRect
IntersectRect
SetCapture
ScreenToClient

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

kernel32

GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetLocaleInfoA
_llseek
ExitProcess
InitializeCriticalSection
GetACP
EnterCriticalSection
GetLastError
GetProcAddress
lstrlenW
GetCurrentThreadId
GetTempFileNameW
FindNextFileW
GetTempPathW
SetThreadAffinityMask
FreeLibrary
CreateDirectoryW
SetFileAttributesW
GetFullPathNameW
DeleteCriticalSection
GetModuleFileNameW
TerminateProcess
DeleteFileW
FindClose
OutputDebugStringW
GetVersionExA
GetProcessIoCounters
GetCurrentProcessId
FindFirstFileW
InterlockedDecrement
GetVersionExW
InterlockedExchange
CopyFileW
InterlockedIncrement
RemoveDirectoryW
Sleep
LoadLibraryW
CreateFileW
GetThreadLocale
lstrlenA
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
GetModuleFileNameA
LeaveCriticalSection
GetTickCount
GlobalUnlock
CloseHandle
LocalFree
GlobalLock
QueryPerformanceCounter
ReadFile
LocalAlloc
GetFileAttributesExW

ole32

StringFromGUID2
CoUninitialize
CoFreeUnusedLibraries
CoInitialize
CoCreateInstance

winmm

timeGetTime

Sections

.text
Size: 292KB - Virtual size: 291KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bomex
Size: 4KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d128dc9ea5cce5accefa70ca213b502f

Headers

File Characteristics

Imports

shlwapi

user32

winspool.drv

kernel32

ole32

winmm

Sections

.text Size: 292KB - Virtual size: 291KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 103KB - Virtual size: 103KB

.bomex Size: 4KB - Virtual size: 28KB

.text
Size: 292KB - Virtual size: 291KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 103KB - Virtual size: 103KB

.bomex
Size: 4KB - Virtual size: 28KB