18308bfc47dc66dbeb6200610f4cdb40_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

18308bfc47dc66dbeb6200610f4cdb40_JaffaCakes118
Size

144KB
MD5

18308bfc47dc66dbeb6200610f4cdb40
SHA1

26063835b6e7b1c516ac182e07ecf9c18940ba38
SHA256

da647690ef7eb9682aa39776f9c999afc4a0aa4c8fdf5b263cc60ce918cd799a
SHA512

4d0e8a63bc73b59fa2896088d20a829259e814f4bb403388d3bd0ca297c7a5057e7a0403689cf5f1b9c9f105b31a69462020cc9a600638910c3cb1efdb93b1a5
SSDEEP

3072:GZ0ZFqFnOZUx+SmQfJCpKqwTf41zQ+7TfbBrMFL27P+:4lkZUx+DQfJCNwTg6+/fbBrN72

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18308bfc47dc66dbeb6200610f4cdb40_JaffaCakes118

Files

18308bfc47dc66dbeb6200610f4cdb40_JaffaCakes118
.exe windows:5 windows x86 arch:x86

5fcc845d7712e3a20938ac84779706d4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

wcsncmp
strcpy
_vsnprintf

shlwapi

PathCanonicalizeA
StrFormatByteSizeW
PathStripToRootA
StrFormatKBSizeW

shell32

ord750

kernel32

TlsGetValue
GetProfileIntW
SetCommBreak
SetFileTime
SetHandleCount
FatalAppExitW
CreateEventW
SetupComm
QueueUserWorkItem
CancelTimerQueueTimer
RequestDeviceWakeup
OpenEventW
SetVolumeLabelA
FileTimeToDosDateTime
lstrcpyA
GetDiskFreeSpaceExW
SetProcessWorkingSetSize
lstrlenW
LoadLibraryW
OpenFileMappingW
lstrcmpiA
ConnectNamedPipe
SetMailslotInfo
CancelIo

user32

RealGetWindowClassW
DestroyAcceleratorTable
InvertRect
EnumPropsW
GetWindow
LookupIconIdFromDirectory
GetDlgItemTextA
DlgDirListW
GetSystemMetrics
ReleaseCapture
DeregisterShellHookWindow
TileWindows
IntersectRect
LockWindowUpdate
GetDC
DialogBoxIndirectParamW
LoadImageW
VkKeyScanExW
SetCursor
IsCharUpperA
LoadMenuIndirectA
GetRawInputData
TabbedTextOutW
GetClientRect
CreateAcceleratorTableW
DrawTextExA
EnumPropsA
PeekMessageW
GetListBoxInfo
GetMenuContextHelpId
ShowScrollBar
PostThreadMessageW
MessageBoxW
MapWindowPoints
ExcludeUpdateRgn
DispatchMessageW
GetClassNameA
ExitWindowsEx
TranslateMessage

gdi32

ResetDCW
SetMapMode
SetAbortProc
DeleteEnhMetaFile
GetBrushOrgEx
ScaleWindowExtEx
CreateBitmapIndirect
GetTextExtentPointI
GetTextExtentPointW
GetMetaRgn
OffsetClipRgn
GetOutlineTextMetricsA
SetMetaFileBitsEx
AnimatePalette
GetLayout
GetBitmapBits
TextOutW

advapi32

AddAce
CopySid
AddAuditAccessAceEx
IsValidAcl

Exports

Exports

__GetScrollRange@12

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.extext
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 364B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bmem
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedat
Size: 512B - Virtual size: 484B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 892B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5fcc845d7712e3a20938ac84779706d4

Headers

File Characteristics

Imports

ntdll

shlwapi

shell32

kernel32

user32

gdi32

advapi32

Exports

Exports

Sections

.text Size: 11KB - Virtual size: 10KB

.extext Size: 3KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 364B

.bmem Size: 4KB - Virtual size: 3KB

.sedat Size: 512B - Virtual size: 484B

.rsrc Size: 125KB - Virtual size: 124KB

.reloc Size: 1024B - Virtual size: 892B

.text
Size: 11KB - Virtual size: 10KB

.extext
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 364B

.bmem
Size: 4KB - Virtual size: 3KB

.sedat
Size: 512B - Virtual size: 484B

.rsrc
Size: 125KB - Virtual size: 124KB

.reloc
Size: 1024B - Virtual size: 892B