149518a3bf64186a24e908b3f7430709_JaffaCakes118

General

Target

149518a3bf64186a24e908b3f7430709_JaffaCakes118
Size

209KB
MD5

149518a3bf64186a24e908b3f7430709
SHA1

72b68ec7f9cc6fbf76fcc747f6f9ee0ceba768d8
SHA256

a3a4756c40154e00078369df096ff69a4953ee0b9fb015828cbe43a24b1aa74e
SHA512

cc2c8794e3b6057fab8f01be6aabfce1e64cb099c7cdb90e8957928b6488f1c975e75ac24c28325942f5adeb72204b0f6914df72c57a53a08871b531a19c182b
SSDEEP

3072:Aaq5ctoD15rgZjOM00Ez1OfXXxGNrFqqmstTTKd9VxYBv+nHdNN/gLNxuOsv:A55Oa15reXCOfXoNgqmstT0GO9NI3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
149518a3bf64186a24e908b3f7430709_JaffaCakes118

Files

149518a3bf64186a24e908b3f7430709_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fa92bdd194dc459a08e7f1fecc313de7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

user32

MsgWaitForMultipleObjects
ShowWindow
GetDesktopWindow
GetDC
RealGetWindowClassW
ReleaseDC
RegisterWindowMessageA
PostThreadMessageA
CreateDialogParamA
PeekMessageA
wsprintfA
DestroyWindow
GetQueueStatus
DispatchMessageA
wvsprintfA

winmm

timeGetTime
timeSetEvent

kernel32

GetACP
CreateFiber
GetCurrentThreadId
GetSystemTime
SetThreadContext
WaitForMultipleObjects
GetLastError
EnumResourceNamesW
VirtualFree
GetTickCount
IsBadReadPtr
GetThreadPriority
lstrcatA
GetCurrentThread
SetThreadPriority
CreateSemaphoreA

setupapi

CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status

wininet

InternetOpenUrlA
InternetCloseHandle
InternetReadFile
InternetOpenA

advapi32

GetUserNameA
RegOpenKeyExA
CryptDestroyHash
CryptHashData
RegEnumValueA
CryptReleaseContext
CryptGetHashParam
CryptImportKey
RegQueryValueExA
RegEnumKeyExA
CryptEncrypt
RegCreateKeyExA
CryptDestroyKey
RegDeleteValueA
RegSetValueExA
CryptCreateHash
RegCloseKey

Sections

.text
Size: 186KB - Virtual size: 185KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fa92bdd194dc459a08e7f1fecc313de7

Headers

File Characteristics

Imports

user32

winmm

kernel32

setupapi

wininet

advapi32

Sections

.text Size: 186KB - Virtual size: 185KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 20KB - Virtual size: 19KB

.tls Size: 512B - Virtual size: 100KB

.text
Size: 186KB - Virtual size: 185KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 20KB - Virtual size: 19KB

.tls
Size: 512B - Virtual size: 100KB