42ffc36a63029974453444c7d6736046_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

42ffc36a63029974453444c7d6736046_JaffaCakes118
Size

3.8MB
MD5

42ffc36a63029974453444c7d6736046
SHA1

043bc17c1d3212240542eff820825ff2f5688dc3
SHA256

c342b2da939aa222d2e9f7e197d587c1f2a92ac4da87610689568b738a707c48
SHA512

2fec6b54aa308aad6571913e5074337b0d012dcb51f270ff8eea65b441e412da54955e5f63ab4f7c131288aa41590ed2c59bd8a28e533482c8f5ec4d250d2533
SSDEEP

98304:2PFiLgHEenAfd/WGNvpxLusmddB00RngGp:2SuEvlOCusm+Agk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42ffc36a63029974453444c7d6736046_JaffaCakes118

Files

42ffc36a63029974453444c7d6736046_JaffaCakes118
.exe windows:4 windows x86 arch:x86

215c35187ea8ee35fecb40685e1df41a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadDirectoryChangesW
VirtualAllocEx
VirtualLock
GetStartupInfoA
SetFileTime
RemoveDirectoryA
SetProcessAffinityMask
DeleteCriticalSection
SystemTimeToFileTime
GetModuleHandleA
GlobalFindAtomW
SetConsoleTitleA
GetFileInformationByHandle
GetCurrentDirectoryW
FatalAppExitA
GetCommandLineW
EnumSystemCodePagesA
VirtualProtect
GetTapeStatus
GetWindowsDirectoryA
WritePrivateProfileSectionW
GetCompressedFileSizeW
GetTempPathW
ReadFile
CreateIoCompletionPort
EnumCalendarInfoW
SetFileAttributesA
PrepareTape
FindFirstFileW
ReadFileScatter
SetCurrentDirectoryA
SetTimeZoneInformation
RaiseException
ReadConsoleOutputA
lstrcpyA
DuplicateHandle
DebugBreak
CreateDirectoryA
LoadLibraryExW
EnumResourceLanguagesW
ExitProcess

user32

UnhookWindowsHook
LoadImageW
CreateWindowStationW
SendDlgItemMessageA
GetMessageTime
GetSubMenu
DestroyMenu
UnregisterClassA
SetLastErrorEx
TrackMouseEvent
EndPaint
DrawTextExA
GetWindowContextHelpId
ShowCaret
UnionRect
CallNextHookEx
MapVirtualKeyExW
GetWindowRgn
DialogBoxIndirectParamW
CloseDesktop
ShowCursor
GetProcessWindowStation
SendMessageCallbackW
SetUserObjectInformationW
TranslateMessage
GetKeyboardLayoutNameA
LoadKeyboardLayoutW
CallWindowProcA
SetScrollRange
EnumDesktopWindows
UnregisterClassW
SetScrollPos

comctl32

ImageList_SetImageCount

advapi32

OpenSCManagerA
SetEntriesInAclW
ControlService
RegEnumValueA
LookupAccountSidA
CryptDeriveKey
RegEnumValueW
RegEnumKeyExW
ReportEventW
CryptSetProvParam
InitializeAcl
SetEntriesInAclA
RegLoadKeyW
RegRestoreKeyA
RegQueryInfoKeyW

version

VerQueryValueA

msvcrt

_isatty
_open_osfhandle
_close
_ultoa
wcstombs
_dup2
_fdopen
_tzset
fgetc
_wcsicoll
_pipe

Sections

.text
Size: 14KB - Virtual size: 233KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

215c35187ea8ee35fecb40685e1df41a

Headers

File Characteristics

Imports

kernel32

user32

comctl32

advapi32

version

msvcrt

Sections

.text Size: 14KB - Virtual size: 233KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 3.5MB - Virtual size: 3.5MB

.rsrc Size: 19KB - Virtual size: 18KB

.text
Size: 14KB - Virtual size: 233KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 3.5MB - Virtual size: 3.5MB

.rsrc
Size: 19KB - Virtual size: 18KB