49825fedf60e8655df385e5daf1821d6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

49825fedf60e8655df385e5daf1821d6_JaffaCakes118
Size

154KB
MD5

49825fedf60e8655df385e5daf1821d6
SHA1

2fbf0d2c745a2b06eb395296ccd2bd1f08845956
SHA256

9354eb171344f1b109ee85ae1a1278d04c4472f56793dd17a252a7da14a269f4
SHA512

e77f44530194f778d4f39a24dbc9f2c6af4b3e34e4b1e42a8e20a240ba32039c819c322d960ac3cae9c2d7b2c073098ac146d1e35c655b9e4d5fca258adc23ba
SSDEEP

3072:SN5/lMR3r1hC3YBXtcbObBD0A40wb3r2RMPbdzLMk7W4S9+Dn15+M7Nz2x:l3rW3YB9VtrQb3r2mpXMpVS5+el

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49825fedf60e8655df385e5daf1821d6_JaffaCakes118

Files

49825fedf60e8655df385e5daf1821d6_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b51bdaf4a6381bdc4dd90a4ef3b057e1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\vlUtXYhkqqCjW\qlWatrr\phcBXhy.pdb

Imports

msvcrt

gets
fprintf
_controlfp
bsearch
malloc
iswctype
mktime
qsort
tolower
isalnum
isspace
__set_app_type
calloc
__p__fmode
getenv
islower
system
fclose
memset
__p__commode
isupper
swprintf
wcscmp
strerror
_amsg_exit
_initterm
isdigit
strncpy
fgets
strncmp
perror
_ismbblead
iswprint
_XcptFilter
towupper
wcsrchr
_exit
wcstol
_cexit
strpbrk
vswprintf
strcoll
__setusermatherr
__getmainargs
wcstombs
ftell
fgetc
exit

comdlg32

GetOpenFileNameA
GetOpenFileNameW
GetFileTitleW
PageSetupDlgW
ReplaceTextW
GetSaveFileNameW

kernel32

FlushFileBuffers
SetThreadContext
DisconnectNamedPipe
SetThreadAffinityMask
SystemTimeToFileTime
GetACP
RegisterWaitForSingleObject
MapViewOfFile
HeapFree
CreateRemoteThread
OpenSemaphoreW
EnterCriticalSection
SetCurrentDirectoryW
GetFileAttributesW
HeapLock
CreateFileW
GetProcessHeap
GetStringTypeExW
ConnectNamedPipe
GetWindowsDirectoryA
VerifyVersionInfoW
CreateFileA
GetCurrentThread
DeleteCriticalSection
WinExec
GetLocalTime
GetModuleFileNameW
LocalFree
IsDBCSLeadByteEx
ConvertDefaultLocale
lstrcatA
GetTempFileNameA
GetCurrentThreadId
GetCommandLineA
DeleteAtom
LockFile
IsBadStringPtrW
GetOverlappedResult
CopyFileA
MoveFileA
SetThreadPriority
GetTempPathA
GlobalCompact
GetAtomNameA
SetHandleCount
FileTimeToLocalFileTime
GetModuleHandleA
HeapAlloc
SetFileTime
EnumResourceLanguagesA
MoveFileW
OpenEventA
GetFileInformationByHandle
OpenEventW
CompareFileTime
GetTimeZoneInformation
lstrcmpW
SetMailslotInfo
VirtualFree

shlwapi

StrToIntW

user32

WindowFromPoint
EnumChildWindows
RegisterHotKey
EnumWindows
GetWindowTextW
CharPrevW
IntersectRect
MapVirtualKeyExW
GetMessageW
LookupIconIdFromDirectory
keybd_event
GetDlgItemTextW
RegisterWindowMessageA
LoadBitmapW
InflateRect
GetMessagePos
VkKeyScanW
GetKeyNameTextW
FindWindowExA
RegisterClassExW
GetWindowDC
HideCaret
GetScrollInfo
CharUpperBuffW
CallWindowProcA
FindWindowA
MapDialogRect
GetClassInfoExW
SetPropW
GetDC
CreatePopupMenu
GetWindowRect
CharToOemBuffA
MessageBoxExA
AdjustWindowRectEx
SetSysColors
SystemParametersInfoA
CheckDlgButton
RegisterClassW
IsCharLowerA
WaitForInputIdle
SetWindowTextA
GetSubMenu
GetMenuItemCount
InsertMenuA
GetDlgCtrlID
CharNextExA
ReplyMessage
UpdateWindow
DialogBoxParamW
LoadStringA
MapVirtualKeyW
MonitorFromRect
FillRect
SendMessageTimeoutW
SendDlgItemMessageW
IsIconic
GetForegroundWindow
SetParent
PeekMessageA
MapVirtualKeyA
LoadBitmapA
ShowScrollBar
IsChild
InSendMessage
GetClassInfoExA
DrawIconEx
ExitWindowsEx
CreateDialogParamW
GetWindowModuleFileNameW
TileWindows
SetLastErrorEx
CharUpperBuffA
GetParent
EnumThreadWindows
MonitorFromPoint
GetMenu
IsZoomed
GetFocus
GetMessageExtraInfo
SetWindowLongA
InsertMenuW
GetCaretBlinkTime
wsprintfW
RegisterClassExA
LoadCursorA
GetSystemMenu
SetMenuItemInfoW
GetGUIThreadInfo
AttachThreadInput
SetRect
DrawFocusRect
ClientToScreen
CheckMenuItem
IsRectEmpty
MapWindowPoints
BeginPaint
GetMenuCheckMarkDimensions
IsMenu
wvsprintfW
GetDlgItemInt
CharPrevA
SetMenuDefaultItem
EnableScrollBar
GetKeyState
GetClipCursor
SetMenuItemBitmaps
GetDlgItem
SetCaretPos
AdjustWindowRect
CharUpperA
AllowSetForegroundWindow
PostQuitMessage
SendDlgItemMessageA
CharToOemA
UnionRect
ScrollWindow
DestroyAcceleratorTable
ReleaseDC
SwitchToThisWindow
SetForegroundWindow
GetWindowTextA
IsCharUpperA
SetScrollRange
GetKeyboardType
IsDialogMessageA
GetDCEx

Exports

Exports

?GenericOutputInfoYSUh@@YGK_KHE[D

Sections

.text
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b51bdaf4a6381bdc4dd90a4ef3b057e1

Headers

File Characteristics

PDB Paths

Imports

msvcrt

comdlg32

kernel32

shlwapi

user32

Exports

Exports

Sections

.text Size: 67KB - Virtual size: 66KB

.data Size: 15KB - Virtual size: 80KB

.rsrc Size: 69KB - Virtual size: 68KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 67KB - Virtual size: 66KB

.data
Size: 15KB - Virtual size: 80KB

.rsrc
Size: 69KB - Virtual size: 68KB

.reloc
Size: 2KB - Virtual size: 1KB