5e0db2ef6e2511b71f6d32521e359f13_JaffaCakes118

General

Target

5e0db2ef6e2511b71f6d32521e359f13_JaffaCakes118
Size

211KB
MD5

5e0db2ef6e2511b71f6d32521e359f13
SHA1

a04924f23ab90362a20df7b976ba7ad6b194cfc5
SHA256

3e9f5e66bc50fc9e482b05e27b268a80270a534a806c5299d354238ad60c50b6
SHA512

0875050f52f32a4148fa73d90344cad1b6bdbd97f24ddf4cd5e4de632d31ee32265cd0dab4c9c0872ce847eaba7317140c369ef4aad93f7573a55203d882bced
SSDEEP

3072:OOPUhXc1OLzY28JVNcMIaqTnRSuZq686bTQTLUc6N+0xPA1rxdfxgSBBB1n+PQeP:OOPUvY2gC5a40uQR5HcWdfxg0BB1GQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5e0db2ef6e2511b71f6d32521e359f13_JaffaCakes118

Files

5e0db2ef6e2511b71f6d32521e359f13_JaffaCakes118
.exe windows:4 windows x86 arch:x86

042637850a3034529b8820692981de0e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrToIntA

kernel32

ExitProcess
FreeLibrary
LoadLibraryExA
GetPrivateProfileIntA
CloseHandle
SetFilePointer
CreateFileA
GetVolumeInformationA
ReadFile
GetDriveTypeA
GetLogicalDrives
GetTickCount
lstrcpyA
lstrcatA
GetModuleFileNameA
GetModuleHandleA
GetEnvironmentVariableA
GetPrivateProfileStringA
lstrcmpiA
lstrlenA
lstrcmpA
SetErrorMode

user32

SetForegroundWindow
GetAsyncKeyState
SendMessageA
GetWindowTextW
FindWindowA
DispatchMessageA
GetMessageA
MessageBoxA
CreateWindowExA
RegisterClassA
RegisterWindowMessageA
CharNextA
CharNextW
CreatePopupMenu
GetCursorPos
InsertMenuItemA
SetMenuDefaultItem
TrackPopupMenu
DestroyMenu
LoadImageA
DestroyIcon
DefWindowProcA
DestroyWindow
PostQuitMessage
SetTimer
wsprintfA
EnableMenuItem

advapi32

RegCloseKey
RegQueryValueExA
RegDeleteValueA
RegCreateKeyA
RegSetValueExA
RegOpenKeyA

shell32

ShellExecuteA
SHGetSpecialFolderPathA
Shell_NotifyIconW

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 176KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

042637850a3034529b8820692981de0e

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

advapi32

shell32

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 176KB - Virtual size: 188KB

.rsrc Size: 26KB - Virtual size: 25KB

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 176KB - Virtual size: 188KB

.rsrc
Size: 26KB - Virtual size: 25KB