14c4e20daf8cbd32b4995e064c91a129_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

14c4e20daf8cbd32b4995e064c91a129_JaffaCakes118
Size

440KB
MD5

14c4e20daf8cbd32b4995e064c91a129
SHA1

775389119c5251964fb8cbb96d7d14dab9e9f909
SHA256

c556c6b567dc5c932f9d8b789e70c87913950edb111e3ec9ce659c8354f50c19
SHA512

ba899ddd25343bc2f10f1f1146f2669d49a04810d8940f3e7ff1c5aa9b7425e68f8b3c3799cf749da60f10757cdacfe2ed3c01f05ae245d95dc9f912cea2de38
SSDEEP

6144:oORTL9BbQbDVYmU+7q7CGDuo7f4oDAqGc/PVb8Tbq3+UQBZuqVAXiom:oM/9Bs3VYmfCDuroDu89m2+UQ+q2Xid

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14c4e20daf8cbd32b4995e064c91a129_JaffaCakes118

Files

14c4e20daf8cbd32b4995e064c91a129_JaffaCakes118
.exe windows:5 windows x86 arch:x86

afd896408c540933d238501b0a0673d9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

gdi32

StretchBlt
CreateHalftonePalette
GetTextMetricsW
SetStretchBltMode
DeleteDC
CreateFontIndirectW
Arc
RealizePalette
GetStockObject

gdiplus

GdipSaveImageToFile
GdipRemovePropertyItem
GdipGetImageEncoders
GdipDeleteGraphics
GdipCloneImage
GdipGetPropertyItemSize
GdipGetImageHeight
GdipAlloc
GdipCreateBitmapFromScan0
GdiplusShutdown

ole32

CoCreateInstance
CoInitialize
CoTaskMemAlloc
CoRegisterClassObject

user32

SetWindowLongW
DeferWindowPos
LoadCursorW
SendNotifyMessageW
CopyRect
FindWindowExW
GetFocus
GetWindowRect
ReleaseCapture
GetDesktopWindow
GetDC
PtInRect
GetCapture
GetClassNameW
LoadIconW
MoveWindow
MonitorFromWindow
MapDialogRect
MonitorFromRect
GetClientRect
DrawTextW
GetWindowLongW
MsgWaitForMultipleObjects
GetParent
SetFocus
CopyImage
RegisterClassExW
GetCursorPos
MessageBeep
SetDlgItemTextW
SetCapture
EndDeferWindowPos
SetPropW
SetTimer
SetWindowPos
PeekMessageW

shlwapi

ord174
ord186
PathFindExtensionW
StrTrimW

msvcrt

__RTDynamicCast
__p__commode
realloc
_adjust_fdiv
_initterm
wcsncpy
_except_handler3
exit
__wgetmainargs
wcstol
_wcmdln

advapi32

RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW

shell32

SHBrowseForFolderW
ord155
SHOpenFolderAndSelectItems
SHGetDesktopFolder
ShellExecuteW
SHGetMalloc
SHChangeNotify
ord748
SHGetFileInfoW
SHGetFolderPathW

kernel32

CreateProcessW
SizeofResource
ReleaseMutex
CreateEventA
EnterCriticalSection
GlobalAlloc
UnmapViewOfFile
GlobalUnlock
lstrlenA
lstrcatW
InitializeCriticalSection
GetCurrentThreadId
VirtualAllocEx
MultiByteToWideChar
FindNextFileW
LoadLibraryExW
CreateThread
OpenFileMappingW
SetCurrentDirectoryW
GetTickCount
lstrcmpW
lstrcpynW
lstrlenW
GetCurrentProcess
CreateFileMappingW
GetWindowsDirectoryW
GetDateFormatW
LeaveCriticalSection
FreeLibraryAndExitThread
CreateMutexW
GetHandleInformation
lstrcmpiW
GetFileAttributesW
SetUnhandledExceptionFilter
WaitForSingleObject
CloseHandle
GetShortPathNameW
GetFullPathNameW

Sections

.text
Size: 393KB - Virtual size: 393KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 304KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

afd896408c540933d238501b0a0673d9

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

gdiplus

ole32

user32

shlwapi

msvcrt

advapi32

shell32

kernel32

Sections

.text Size: 393KB - Virtual size: 393KB

.data Size: 40KB - Virtual size: 39KB

.rsrc Size: 6KB - Virtual size: 304KB

.text
Size: 393KB - Virtual size: 393KB

.data
Size: 40KB - Virtual size: 39KB

.rsrc
Size: 6KB - Virtual size: 304KB