43da886c5a049c8d6022365fcd5b5443_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

43da886c5a049c8d6022365fcd5b5443_JaffaCakes118
Size

564KB
MD5

43da886c5a049c8d6022365fcd5b5443
SHA1

fd86290b73bed5ec3c67d897b76ca7bf5ec8d9f7
SHA256

c18ed085cd6db05f62ab04b8c99f95f888051284aa907e4d852d139285b1a469
SHA512

8da25b9ab4889d4b1e4b9e7b8e007ef4663f2bc5f94ffdbfb818f0c25973d7f5273cc72477aefa25714fe909d2023dba3de6a7a2d409067bdfdf655cc76c5ac3
SSDEEP

12288:qSknOdW5psjt0FKhD5iP0yn5LE3Cxy01PZkFVD1EeCT3d5btvCr5bNWOet8vpynV:WnCpVhVq0yn5LE3Cxy01PZkFVD1EeCTj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
43da886c5a049c8d6022365fcd5b5443_JaffaCakes118

Files

43da886c5a049c8d6022365fcd5b5443_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ebeeb618687d97fee66e7f2558ff959a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

g:\tfy\aqgt\grzibxozk.pdb

Imports

comctl32

ImageList_GetIconSize
CreateUpDownControl
ImageList_DragMove
MakeDragList
ImageList_AddMasked
InitCommonControlsEx
InitMUILanguage
CreateStatusWindowA
ImageList_Copy
ImageList_DragLeave
ImageList_Destroy
ImageList_Add
ImageList_SetFlags
ImageList_Read
ImageList_Write

user32

UnregisterClassW
SetScrollInfo
InsertMenuItemW
IsDialogMessageW
DragDetect
ActivateKeyboardLayout
GetDlgItemTextA
ChangeClipboardChain
ShowWindow
SetWinEventHook
GetTitleBarInfo
DestroyCursor
MessageBoxA
RegisterClassA
EnumDisplayDevicesW
DdeDisconnectList
GetWindowTextLengthW
GetTabbedTextExtentW
OpenClipboard
DdeImpersonateClient
SetMessageQueue
DialogBoxIndirectParamW
ShowScrollBar
RegisterClassExA
OpenWindowStationW
DispatchMessageA
SetKeyboardState
DestroyWindow
DefWindowProcA
LoadStringW
SetClipboardViewer
RegisterClipboardFormatW
SetRectEmpty
EnableWindow
SetCaretBlinkTime
CreateWindowExA

wininet

SetUrlCacheEntryGroup
FtpCreateDirectoryW
FtpGetFileA
HttpSendRequestA
InternetConfirmZoneCrossing
FtpPutFileA
RetrieveUrlCacheEntryFileA
InternetTimeToSystemTime

advapi32

CryptEnumProviderTypesW
CryptGetProvParam
RegCloseKey
RegSaveKeyA
CryptSignHashA
CryptEncrypt
CreateServiceW
LookupAccountNameA
RegQueryValueExW
CryptSetProviderExA
CryptGetDefaultProviderA
DuplicateTokenEx
RegSetValueA
RegReplaceKeyW
RegEnumValueA
LookupPrivilegeDisplayNameA
RegQueryValueA
LookupAccountSidW
RegQueryValueW
DuplicateToken
RegSaveKeyW
CryptHashSessionKey

gdi32

Polygon
Chord
ChoosePixelFormat
DeleteMetaFile
GetCharABCWidthsA
CreateEnhMetaFileA
EnumMetaFile
CreateScalableFontResourceW
GetOutlineTextMetricsA
AngleArc
DeleteObject
GetViewportOrgEx

kernel32

SetUnhandledExceptionFilter
GetCPInfo
WaitForDebugEvent
GetAtomNameW
EnumSystemLocalesA
OutputDebugStringA
FileTimeToDosDateTime
QueryPerformanceCounter
GlobalAlloc
GetCommandLineA
IsValidLocale
CreateWaitableTimerA
GetCurrentThreadId
UnhandledExceptionFilter
GetModuleFileNameW
VirtualAlloc
GetVolumeInformationW
FindFirstFileA
UnlockFileEx
WriteConsoleW
GetStringTypeA
GetLogicalDriveStringsW
TlsAlloc
LoadLibraryW
InitializeCriticalSection
GetLogicalDriveStringsA
LCMapStringA
GetLocaleInfoW
InterlockedCompareExchange
FillConsoleOutputCharacterA
GetFileType
GetVersionExA
GetLastError
OutputDebugStringW
GetCurrentThread
lstrcpynW
GetSystemDefaultLCID
GetConsoleOutputCP
SetHandleCount
ExitProcess
HeapCreate
TlsSetValue
FreeEnvironmentStringsW
DeleteFiber
GetFileAttributesExW
FindFirstFileExW
GetOEMCP
SetEvent
FreeEnvironmentStringsA
HeapValidate
DeleteCriticalSection
SetEnvironmentVariableA
SetLastError
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetTickCount
GetSystemTimeAsFileTime
GetTimeZoneInformation
lstrcpyA
TerminateProcess
SuspendThread
GetCurrentProcessId
GetCommandLineW
GetStdHandle
UnmapViewOfFile
CreatePipe
TlsFree
GetConsoleCP
CreateMutexA
SetConsoleCtrlHandler
GetComputerNameA
GetLocaleInfoA
GetThreadTimes
GetStartupInfoW
TlsGetValue
GetCurrentProcess
CreateFileA
CreateToolhelp32Snapshot
HeapFree
LockFile
FreeLibrary
LoadLibraryA
GetDateFormatA
GetUserDefaultLangID
EnterCriticalSection
RtlUnwind
HeapAlloc
GetStartupInfoA
CreateWaitableTimerW
SetFilePointer
GetModuleHandleA
LocalAlloc
RaiseException
DebugBreak
GetProcessHeap
CompareStringW
VirtualFree
WriteFile
HeapReAlloc
CloseHandle
InterlockedExchange
SetStdHandle
GetACP
IsDebuggerPresent
IsValidCodePage
CompareStringA
InterlockedIncrement
GetEnvironmentStringsW
GetEnvironmentStrings
SetComputerNameW
LCMapStringW
InterlockedDecrement
ReadFile
SetTimeZoneInformation
OpenMutexA
IsBadReadPtr
EnumSystemCodePagesW
MultiByteToWideChar
GetUserDefaultLCID
FlushFileBuffers
GetModuleFileNameA
GetProcAddress
VirtualQuery
GetConsoleMode
GetThreadSelectorEntry
HeapDestroy
GetStringTypeW
GetCompressedFileSizeW
GetTimeFormatA
lstrlenA
GetDriveTypeW
WriteConsoleA
GlobalFree
WideCharToMultiByte
InterlockedExchangeAdd

Sections

.text
Size: 308KB - Virtual size: 307KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 104KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ebeeb618687d97fee66e7f2558ff959a

Headers

File Characteristics

PDB Paths

Imports

comctl32

user32

wininet

advapi32

gdi32

kernel32

Sections

.text Size: 308KB - Virtual size: 307KB

.rdata Size: 132KB - Virtual size: 130KB

.data Size: 104KB - Virtual size: 105KB

.rsrc Size: 16KB - Virtual size: 13KB

.text
Size: 308KB - Virtual size: 307KB

.rdata
Size: 132KB - Virtual size: 130KB

.data
Size: 104KB - Virtual size: 105KB

.rsrc
Size: 16KB - Virtual size: 13KB