43b850184338e03efcae4afdb2da6315_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

43b850184338e03efcae4afdb2da6315_JaffaCakes118
Size

572KB
MD5

43b850184338e03efcae4afdb2da6315
SHA1

59d6740fad02a3a7ad9996c5b2818dc3d224518f
SHA256

4fb896e9ebc9578dfd4e45210aa26260344c884ea5d65a0aa7103c3f4a452725
SHA512

bdabfe3b2d6163ef8cf8ef460b64ed8532dabdcb456d2241e5a80c6d16a7c9dab04ede7f8783c48fc01d7a7d2dd5210bbbfa2b060d369b18c0a6704d4079dc9f
SSDEEP

6144:KP0CcPBV0yjmNhmGns+aSRfbIhAdoEKSbwAmRml1wia0PnOm8GW0Fe9G+fVJNXgs:KPxcP30yjmNYG63via5WZ+fNwVQt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
43b850184338e03efcae4afdb2da6315_JaffaCakes118

Files

43b850184338e03efcae4afdb2da6315_JaffaCakes118
.exe windows:5 windows x86 arch:x86

473491d85d2704730caf4237e9b467f1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerInstallFileW
VerFindFileA
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA
GetFileVersionInfoA

user32

UpdateWindow
ShowWindow
ShowOwnedPopups
SendMessageA
PostMessageA
OemToCharBuffA
OemToCharA
MessageBoxA
LoadAcceleratorsW
LoadAcceleratorsA
GetMenu
GetDC
DispatchMessageA
DestroyWindow
DeleteMenu
CreateMDIWindowA
CopyImage
ChangeMenuA

ntdll

RtlUpperString
RtlxUnicodeStringToAnsiSize
ZwAccessCheckByTypeAndAuditAlarm
ZwCompleteConnectPort
ZwCreateWaitablePort
ZwEnumerateValueKey
ZwGetContextThread
ZwImpersonateAnonymousToken
RtlUpcaseUnicodeStringToOemString
RtlUnlockHeap
RtlTraceDatabaseAdd
RtlSetUserValueHeap
RtlSetTimer
RtlPinAtomInAtomTable
RtlMakeSelfRelativeSD
RtlImageRvaToVa
RtlImageDirectoryEntryToData
RtlFindLastBackwardRunClear
RtlFillMemory
NtWriteFile
NtSetDefaultUILanguage
NtQueueApcThread
NtLockFile
NtCallbackReturn
NtAreMappedFilesTheSame
LdrFindResourceDirectory_U
RtlNtStatusToDosError

kernel32

_lopen
_hwrite
WaitForMultipleObjectsEx
WaitForMultipleObjects
VirtualProtect
VerLanguageNameA
Thread32Next
SystemTimeToTzSpecificLocalTime
SetVolumeMountPointA
SetLastError
ResumeThread
ReadFileEx
PrepareTape
LocalReAlloc
LoadLibraryExW
IsProcessorFeaturePresent
IsBadStringPtrW
HeapAlloc
GlobalWire
GlobalUnWire
GlobalSize
GlobalMemoryStatusEx
GlobalGetAtomNameW
GlobalDeleteAtom
GetTickCount
GetTempPathA
GetSystemTimeAsFileTime
GetProcAddress
GetFileSize
GetDriveTypeA
GetCommandLineA
FindResourceA
FindClose
ExitProcess
EraseTape
EnumCalendarInfoW
DeleteTimerQueue
DeleteFileA
GetUserDefaultLangID
CreateJobObjectW
CreateIoCompletionPort
CopyFileW
CancelTimerQueueTimer
BuildCommDCBW
BeginUpdateResourceA
GlobalAddAtomW

userenv

GetAppliedGPOListW
LeaveCriticalPolicySection
RegisterGPNotification
UnregisterGPNotification
ExpandEnvironmentStringsForUserW
CreateEnvironmentBlock
DestroyEnvironmentBlock
EnterCriticalPolicySection

Exports

Exports

LUNrFdnwsY
ankgaOdSw
cotwldosqmmd
eEdnyTuWpqsuorx
iphxTIseucpNqykaCtm
kjqlbPIcxip
lmgkfhBlh
obipu
qgrnUKbrdiiKLyksp
vwpzesbw
wkxNnX

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 464KB - Virtual size: 463KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

473491d85d2704730caf4237e9b467f1

Headers

File Characteristics

Imports

version

user32

ntdll

kernel32

userenv

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 55KB

.data Size: 464KB - Virtual size: 463KB

.rsrc Size: 51KB - Virtual size: 51KB

.text
Size: 56KB - Virtual size: 55KB

.data
Size: 464KB - Virtual size: 463KB

.rsrc
Size: 51KB - Virtual size: 51KB