1634a1df0a8b6cf3d5c8857fc90f6e78_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

1634a1df0a8b6cf3d5c8857fc90f6e78_JaffaCakes118
Size

23KB
MD5

1634a1df0a8b6cf3d5c8857fc90f6e78
SHA1

612285d0e9175b5351de72b23459608b23c0e07a
SHA256

2d79bdfc85e0d3c1061a9b5f822f2eb4a746ae0c76b3d87fc5612d0f148c18fd
SHA512

3f358b5b5eaac66b2d7c921305c2a0c9e3958dd2b326ced96bd48735a10e9b50f3266c450aa8f06e33e7105bd2a9691b60ddfd4f3c88f5a77e2aac4178112a0d
SSDEEP

384:4XWWGwWHvLcFWFUmSWoDfKdc3OGojLwJhTrY1IZMeA3QeU61V:aGV4gFUm6DfKztLwJNUBeAAeUU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1634a1df0a8b6cf3d5c8857fc90f6e78_JaffaCakes118

Files

1634a1df0a8b6cf3d5c8857fc90f6e78_JaffaCakes118
.exe windows:4 windows x86 arch:x86

94556b7e5533810156f356e8bae3b753

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc

shell32

SHGetPathFromIDListA
SHAppBarMessage
SHGetFolderLocation
DragQueryFileW
ShellExecuteA
SHBrowseForFolderW
SHGetInstanceExplorer
Shell_NotifyIconA
SHBindToParent
SHPathPrepareForWriteW
ShellAboutW
ExtractIconW
SHGetDesktopFolder
ShellExecuteExW
ExtractAssociatedIconExW
SHFileOperationW
SHSetLocalizedName
ShellExecuteW
SHGetDataFromIDListW
ExtractIconExW
SHGetFolderPathW
Shell_NotifyIconW
SHGetFolderPathAndSubDirW
SHCreateShellItem
SHGetSpecialFolderLocation
SHChangeNotify
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetFileInfoW

rtutils

TraceDumpExA
RouterLogRegisterA
RouterGetErrorStringW
LogErrorW
RouterLogEventStringA
RouterLogEventExA

ddraw

DirectDrawCreate

ntdll

RtlAddAccessAllowedObjectAce
NtSuspendProcess
NtQuerySemaphore
RtlAdjustPrivilege

uxtheme

GetThemeColor
GetThemeMetric
DrawThemeBackground
CloseThemeData
IsAppThemed
GetThemeMargins
DrawThemeParentBackground
GetThemeBackgroundContentRect
IsThemeActive
GetThemeFont
SetWindowTheme
GetThemeAppProperties
GetThemePartSize
OpenThemeData
GetThemeBackgroundExtent

psapi

GetProcessImageFileNameW

Sections

.text
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

94556b7e5533810156f356e8bae3b753

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shell32

rtutils

ddraw

ntdll

uxtheme

psapi

Sections

.text Size: 1024B - Virtual size: 996B

.rsrc Size: 4KB - Virtual size: 4KB

.data Size: 2KB - Virtual size: 80KB

.idata Size: 2KB - Virtual size: 1KB

.rdata Size: 12KB - Virtual size: 11KB

.text
Size: 1024B - Virtual size: 996B

.rsrc
Size: 4KB - Virtual size: 4KB

.data
Size: 2KB - Virtual size: 80KB

.idata
Size: 2KB - Virtual size: 1KB

.rdata
Size: 12KB - Virtual size: 11KB