342dea7b71bdbcf2d70634eaa5e58e9b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

342dea7b71bdbcf2d70634eaa5e58e9b_JaffaCakes118
Size

419KB
MD5

342dea7b71bdbcf2d70634eaa5e58e9b
SHA1

86f4aa060cc2c25e3f55dade123dfd5fa032269c
SHA256

797eb918641024a7ac55acc315193f6bfa43ae50211be75fcc6d60ad5b51f9f3
SHA512

38d8da85b774e045a00a23bd792a459230050d0efe9d8bce16c18d9b0badc51f8f8351a40302440facea53e49d086641601f3b3aab43f8be3cbee5dbe05d5fe2
SSDEEP

6144:pp4RyggzrAo3VN5KmQqvDQUWHJ62QWM6vlnLLNcVaUP73uMrSBBjoq6+54ChbF+s:Jtzrt/v8UAQJ6FiRjVsvd54+5Ff

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
342dea7b71bdbcf2d70634eaa5e58e9b_JaffaCakes118

Files

342dea7b71bdbcf2d70634eaa5e58e9b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5418e158c126e13756c588109338833d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

RealShellExecuteExW
SHFileOperationW
ShellHookProc
SHFileOperation

comdlg32

PrintDlgA

advapi32

CryptSetHashParam
RegCreateKeyA
CryptEnumProvidersW
StartServiceW
CryptSignHashA
RegReplaceKeyW
CryptGenKey
RegSetValueExW
CreateServiceA
RegEnumKeyExA
CryptGetDefaultProviderW
LookupPrivilegeValueW
CryptReleaseContext
RegOpenKeyW
LogonUserA

gdi32

LineTo
TextOutW
EnumICMProfilesA

kernel32

SetLastError
QueryPerformanceCounter
GetSystemTimeAsFileTime
TlsFree
SetFilePointer
GetCPInfo
LeaveCriticalSection
SetHandleCount
GetOEMCP
HeapFree
GetStringTypeW
GetVersion
ResetEvent
GetModuleHandleA
GetCurrentProcess
DeleteCriticalSection
GetLogicalDriveStringsW
LCMapStringW
GetStringTypeA
GetModuleFileNameA
LoadLibraryA
GetACP
GetCommandLineA
UnhandledExceptionFilter
GetEnvironmentStringsW
SetConsoleCtrlHandler
LCMapStringA
GetProcAddress
GetEnvironmentStrings
GetStartupInfoA
MoveFileW
FreeEnvironmentStringsW
RtlUnwind
FreeEnvironmentStringsA
GetUserDefaultLCID
GetProfileIntA
GetCurrentThread
VirtualAlloc
VirtualLock
MultiByteToWideChar
TlsSetValue
HeapCreate
GetCurrentProcessId
HeapAlloc
ExitProcess
VirtualQuery
HeapDestroy
HeapReAlloc
GetLastError
LoadResource
TerminateProcess
FlushViewOfFile
InitializeCriticalSection
IsBadWritePtr
TlsAlloc
SetVolumeLabelA
EnterCriticalSection
InterlockedExchange
GetFileType
GetCurrentThreadId
VirtualFree
WideCharToMultiByte
WriteFile
GetStdHandle
TlsGetValue
GetTickCount

wininet

GopherGetLocatorTypeA

Sections

.text
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 277KB - Virtual size: 277KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5418e158c126e13756c588109338833d

Headers

File Characteristics

Imports

shell32

comdlg32

advapi32

gdi32

kernel32

wininet

Sections

.text Size: 124KB - Virtual size: 124KB

.rdata Size: 3KB - Virtual size: 8KB

.data Size: 277KB - Virtual size: 277KB

.rsrc Size: 13KB - Virtual size: 12KB

.text
Size: 124KB - Virtual size: 124KB

.rdata
Size: 3KB - Virtual size: 8KB

.data
Size: 277KB - Virtual size: 277KB

.rsrc
Size: 13KB - Virtual size: 12KB