1629694ce4ee51b86014603f7991173e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

1629694ce4ee51b86014603f7991173e_JaffaCakes118
Size

165KB
MD5

1629694ce4ee51b86014603f7991173e
SHA1

6e0dc539d3453080d4e6c9988f2cb921e9d0d620
SHA256

5ca4de22a13c245de1aa8b62b129700950c7ecf1ffcf6f597046fa7b6de211b6
SHA512

288c367c5fe0ad6b39f8b5650e134909197ed494a36107b30bd90cafc0b3db3dd55abc1539634b81de0288f9e73b73783298708b98b2fa31382c8ba194a9d55e
SSDEEP

3072:ijZ6/EGqk3tMWJAGUp2+2ahw//9O9vK6IrYbfuC6UCUc+6sF2AxLK:iQcGqk3tMLJsWFYcC350X

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1629694ce4ee51b86014603f7991173e_JaffaCakes118

Files

1629694ce4ee51b86014603f7991173e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d9de2ecd29cdbc447c689a4a1b8de57a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLocaleInfoA
RtlUnwind
HeapAlloc
SetHandleInformation
LoadLibraryA
GetEnvironmentStringsW
SetHandleCount
GetCurrentProcess
InterlockedDecrement
TerminateProcess
HeapReAlloc
QueryPerformanceCounter
SizeofResource
TlsFree
GetSystemInfo
VirtualQuery
FlushInstructionCache
GetModuleHandleA
GetCurrentThreadId
TlsAlloc
GetStartupInfoA
HeapCreate
SetFilePointer
GetThreadLocale
GetStdHandle
LeaveCriticalSection
TransmitCommChar
LoadResource
GetCommandLineA
HeapDestroy
IsBadReadPtr
EnterCriticalSection
RaiseException
GetFileType
SetUnhandledExceptionFilter
MulDiv
ExitProcess
GetTickCount
GetLastError
UnhandledExceptionFilter
lstrcmpiA
IsBadWritePtr
IsDBCSLeadByte
TlsGetValue
VirtualProtect
lstrcpyA
LockResource
GetProcAddress
GetVersionExA
EnumResourceNamesW
IsBadCodePtr
WideCharToMultiByte
WriteFile
lstrcatA
LCMapStringA
lstrlenW
DeleteCriticalSection
FreeLibrary
GetOEMCP
GetCPInfo
FreeEnvironmentStringsA
InterlockedExchange
VirtualAlloc
GetStringTypeW
CloseHandle
ExitProcess
DisableThreadLibraryCalls
LCMapStringW
VirtualFree
TlsSetValue
MultiByteToWideChar
InterlockedIncrement
SetLastError
GetCurrentProcessId
GetProcessHeap
lstrlenA
InitializeCriticalSection
GetACP
FreeEnvironmentStringsW
lstrcpynA
SetStdHandle
GetSystemTimeAsFileTime
GetModuleFileNameA
HeapSize
GetStringTypeA
FlushFileBuffers
LoadLibraryExA
FindResourceA
GetEnvironmentStrings
HeapFree

gdi32

GetTextExtentPointA
DeleteObject
GetTextMetricsA
SelectObject
GetDeviceCaps
CreateFontIndirectA

user32

UnregisterClassA
CheckDlgButton
MoveWindow
SetDlgItemTextA
IsDlgButtonChecked
GetDlgItemTextA
GetDlgItem
GetDialogBaseUnits
GetDC
DestroyWindow
SetWindowLongA
EnableWindow
IsWindow
WinHelpA
SendMessageA
CreateDialogParamA
ReleaseDC
ShowWindow
IsDialogMessageA
CharNextA

advapi32

RegSetValueExA
RegDeleteValueA
RegOpenKeyExA
RegEnumKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteKeyA
RegQueryInfoKeyA

msimg32

AlphaBlend
TransparentBlt

shlwapi

PathFindExtensionA

ole32

CoTaskMemAlloc
StringFromGUID2
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc

Sections

.text
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crt
Size: 512B - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d9de2ecd29cdbc447c689a4a1b8de57a

Headers

File Characteristics

Imports

kernel32

gdi32

user32

advapi32

msimg32

shlwapi

ole32

Sections

.text Size: 140KB - Virtual size: 140KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 19KB - Virtual size: 18KB

.crt Size: 512B - Virtual size: 68KB

.text
Size: 140KB - Virtual size: 140KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 19KB - Virtual size: 18KB

.crt
Size: 512B - Virtual size: 68KB