1bda303850480227287f6f4f2a1a5085_JaffaCakes118

General

Target

1bda303850480227287f6f4f2a1a5085_JaffaCakes118
Size

52KB
MD5

1bda303850480227287f6f4f2a1a5085
SHA1

b408114788bf83bae2dd0275ef4bf84c83511151
SHA256

9af51fa46bf2306f2187dddd505298f0e70592063c858e57dea457ea85c50bc8
SHA512

5660145860a341c9af550dd6425502e4ab9866cdc04896bc11a13491c27a129f68786ae58ba6b22575e924412b597114a4e0ca128f2a345e193ba5cbbae30738
SSDEEP

1536:1oZPIwF1xdz84QxO4uIykBbHcc9zWgRUDb:031xdvQAkBQQzWPDb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1bda303850480227287f6f4f2a1a5085_JaffaCakes118

Files

1bda303850480227287f6f4f2a1a5085_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c70f1b295638f822afc590de4216302b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetCursorPos
GetClipboardData
EndDialog
OpenDesktopA
ExitWindowsEx
GetDlgItem
GetWindowLongA
GetDlgItemTextA
DrawIcon
OpenWindowStationA
SetThreadDesktop
MsgWaitForMultipleObjects
PeekMessageA
GetWindowThreadProcessId
GetMessageA
ToUnicode
SendMessageA
GetWindowTextA

kernel32

CopyFileW
GetEnvironmentVariableW
GetDiskFreeSpaceW
TryEnterCriticalSection
VirtualProtect
GetModuleHandleA
VirtualAlloc
ReleaseMutex
ExpandEnvironmentStringsW
lstrlenW
lstrcatA
OpenMutexW
GetModuleFileNameA
GetLastError
FindClose
SystemTimeToFileTime
CreateEventW
GetLocalTime

shlwapi

PathRemoveFileSpecW
wvnsprintfW
wvnsprintfA
PathFileExistsW
StrCmpNIW
PathCombineW
SHDeleteKeyA
wnsprintfW
PathFindFileNameW

advapi32

CryptGetHashParam
RegEnumKeyExA
CryptReleaseContext
RegDeleteValueA
GetUserNameW
RegSetValueExA
RegCreateKeyExA
DuplicateTokenEx
CryptHashData
CryptAcquireContextW
CryptDestroyHash

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c70f1b295638f822afc590de4216302b

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

shlwapi

advapi32

Sections

.text Size: 48KB - Virtual size: 48KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 24KB

.text
Size: 48KB - Virtual size: 48KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 24KB