4e03e898763ac366f39f56d6b446626b_JaffaCakes118

General

Target

4e03e898763ac366f39f56d6b446626b_JaffaCakes118
Size

188KB
MD5

4e03e898763ac366f39f56d6b446626b
SHA1

8614749f6f05c71f3cf654f4a7d485197aa8d4a3
SHA256

974f2a1223c9d2d34c566343ccd99209e1515f0bd73ab3d64531d308b691c7fe
SHA512

00e66cf4b3f626aa93c84b993fbbf767a95f29fb47147208448106019e6bf9bffacacc4d1032eea16f6e67945004d8ac82eeff63c12e4711ec17f71b00d91c3a
SSDEEP

3072:K6lI6VEYqQnW1a98nzw4edQPw0ehGI3xhxRbHiZfnXDRodVoA6HtbYbGJnAnnnnR:KGqQnW1a9Q+sFIhhxmftYujn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4e03e898763ac366f39f56d6b446626b_JaffaCakes118

Files

4e03e898763ac366f39f56d6b446626b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

25d8b1c1dcb2d8ed029fbc77e875eeba

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfA
GetActiveWindow
FlashWindow
CharNextA

kernel32

GetFileAttributesA
FreeLibrary
LocalAlloc
InterlockedExchange
RaiseException
ExitProcess
GetProcessId
GetCurrentProcess
GetProcAddress
GetModuleHandleA
GetLastError
Sleep
LoadLibraryA
GetCurrentDirectoryA
GetTempPathA
MoveFileA
CloseHandle
SetFileTime
GetFileTime
GetWindowsDirectoryA
WriteFile
GetCurrentThreadId
CreateFileA
SleepEx
GetModuleFileNameA
WaitForSingleObject
CreateEventA
GetTickCount
GetShortPathNameA
ExpandEnvironmentStringsA
GetSystemDirectoryA
SetUnhandledExceptionFilter
GetCommandLineA
CreateDirectoryA
GetStartupInfoA
DeleteFileA
SetFileAttributesA

msvcrt

memset
memcpy
rand
memmove
??2@YAPAXI@Z
srand
__CxxFrameHandler
_ftol
memcmp
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
_controlfp
_except_handler3
_strrev
_strlwr
_strupr

shlwapi

SHDeleteKeyA

ws2_32

getprotobynumber
closesocket

Sections

CODE
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 164KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

25d8b1c1dcb2d8ed029fbc77e875eeba

Headers

File Characteristics

Imports

user32

kernel32

msvcrt

shlwapi

ws2_32

Sections

CODE Size: 12KB - Virtual size: 10KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 164KB - Virtual size: 165KB

.rsrc Size: 4KB - Virtual size: 1KB

CODE
Size: 12KB - Virtual size: 10KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 164KB - Virtual size: 165KB

.rsrc
Size: 4KB - Virtual size: 1KB