42c7a5c2a0fe0255af7ebf1dedb16f43_JaffaCakes118

General

Target

42c7a5c2a0fe0255af7ebf1dedb16f43_JaffaCakes118
Size

117KB
MD5

42c7a5c2a0fe0255af7ebf1dedb16f43
SHA1

36a15c6ed349e6de9be7ed28ef91ecb894f32020
SHA256

c90e7398b70c4f6aabd879d8073fb0586c66f9f4c3674ee136c20d69026fc1b7
SHA512

f59f7e11c2ae6dfc7a1108b7cf6329772bd950237d0c1ee31dc79472b199e265ce6ceafe602c1b7308dac450f50a1001c2c78838e635f3c51d7424418e62e4ec
SSDEEP

1536:j8QxEfIDUUGvXtwTeYNKctOLBd8LPOTYeGpzkqd7PI7n62Zd46TNQOtAf65fSQ1m:j8QqfIDuv9YltVOce2zkqVhompQNx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42c7a5c2a0fe0255af7ebf1dedb16f43_JaffaCakes118

Files

42c7a5c2a0fe0255af7ebf1dedb16f43_JaffaCakes118
.exe windows:5 windows x86 arch:x86

2dcd2bd953a5977791b5fa957639db09

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlFreeUnicodeString
RtlInitUnicodeString
_chkstk

kernel32

lstrcmpiW
lstrcpyA
CloseHandle
VirtualQuery
GetCurrentProcess
Sleep
SetLastError
GetProcAddress
LoadLibraryA
GetModuleHandleA
VirtualProtect
ExitProcess
CreateFileA
GetFileSize
SetPriorityClass
lstrlenA
FreeLibrary
WaitForSingleObject
GetTickCount
VirtualFree
GetProcessHeap
WriteFile
TerminateProcess
ReadFile
lstrcatA
MultiByteToWideChar
SetThreadPriority
GetShortPathNameA
CreateDirectoryA
GetLastError
lstrcmpiA
VirtualAlloc
CopyFileA
LocalAlloc
GetSystemInfo
GetModuleFileNameA
WinExec
LoadLibraryExA
CreateMutexA
GetVersionExA

shlwapi

StrDupA

user32

EndPaint
LoadCursorA
FindWindowA
UpdateWindow
SetWindowTextA
GetSystemMetrics
DispatchMessageA
ShowWindow
DefWindowProcA
CreateWindowExA
MessageBoxA
TranslateMessage
BeginPaint
RegisterWindowMessageA
SendMessageA
SetFocus
CharUpperA
LoadIconA
GetTopWindow
GetClassInfoExA
PostQuitMessage
RegisterClassExA
CreateDialogParamA
GetMessageA

shell32

ord680

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 102KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2dcd2bd953a5977791b5fa957639db09

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

shlwapi

user32

shell32

Sections

.text Size: 13KB - Virtual size: 13KB

.data Size: 102KB - Virtual size: 107KB

.rsrc Size: 512B - Virtual size: 16B

.text
Size: 13KB - Virtual size: 13KB

.data
Size: 102KB - Virtual size: 107KB

.rsrc
Size: 512B - Virtual size: 16B