64a3e2681afd27607ac7ca6942ddad97_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

64a3e2681afd27607ac7ca6942ddad97_JaffaCakes118
Size

274KB
MD5

64a3e2681afd27607ac7ca6942ddad97
SHA1

4864fd43aa5fc49aca5977a6fcf01494b65cef19
SHA256

617efa76f0f1d9cf86e42d5ca694a1a22522c65041d6fb173612e09978e26b3f
SHA512

4274f4ba601664048d4fd06f2b003074432009a15dbb336dc6ca77c3c6684f6e49e454ef2f19aa6dc7f1bf0dbbaa11724ab5f29ad33ee2019e4655ed70e6dfac
SSDEEP

6144:J9IQFOO8cZlnXS7RMaZMdJ1ZcU9RuOy5vmsEyP5YP1:i3cZlC7RMa439YOy5vmsEA5a1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64a3e2681afd27607ac7ca6942ddad97_JaffaCakes118

Files

64a3e2681afd27607ac7ca6942ddad97_JaffaCakes118
.exe windows:5 windows x86 arch:x86

5da23f3498aea8fce475641ba7a2fde4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

CreateStatusWindowA
InitCommonControls
ImageList_Draw
ImageList_ReplaceIcon
InitCommonControlsEx
ImageList_AddMasked
ImageList_Destroy
CreatePropertySheetPageW
PropertySheetA
CreatePropertySheetPageA
DestroyPropertySheetPage
ImageList_Create

gdi32

CreateCompatibleDC
PtVisible
CreateDIBitmap
GetCharWidthA
SetPixelV
SetTextColor
SetBkColor
GetTextColor
SetICMMode
Polyline
StartDocA
GetTextFaceW
StrokeAndFillPath

user32

GetWindowLongW
CheckMenuItem
KillTimer
GetWindowDC
CreateWindowExW
GetSubMenu
MessageBoxW
GetSystemMenu
GetDlgItemTextW
IsRectEmpty
GetClientRect
IsDlgButtonChecked
GetWindowTextA
MapWindowPoints
GetWindowThreadProcessId
CopyRect
ScreenToClient
UnregisterClassW
MoveWindow
EnumChildWindows
TranslateMessage
SendMessageA
SetCursor
GetDlgCtrlID
GetMessageW
GetWindowTextW
IsChild
EnableWindow
LoadStringW
SetRect

comdlg32

ChooseFontW
GetFileTitleW
GetSaveFileNameA
GetOpenFileNameA
ChooseFontA
CommDlgExtendedError
GetFileTitleA
GetOpenFileNameW
GetSaveFileNameW

msvcrt

_wcsicmp
_mbsnbcpy
memmove
_controlfp
srand
_ltoa
_wtol
fwrite
printf
_write
__p___initenv
__p__fmode

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeW
GetFileVersionInfoW
GetFileVersionInfoSizeA

kernel32

GetCurrentDirectoryW
LoadLibraryA
GetFileType
GetCurrentThreadId
RaiseException
VirtualAlloc
GetLocalTime
LoadResource
GetTimeFormatA
GetCurrentProcessId
LeaveCriticalSection
GetLastError
lstrcatA
VirtualFree
GetModuleHandleW
UnmapViewOfFile
GetCommandLineW
ExitProcess
InterlockedCompareExchange
GlobalHandle

shlwapi

PathIsRootW
PathFindExtensionW
StrStrW
PathIsRelativeW
SHStrDupW
PathFindFileNameA
PathIsDirectoryW
PathRemoveExtensionW
PathRemoveBlanksW
StrStrIA
SHSetValueW
PathGetDriveNumberW
PathAddBackslashW
StrChrIW
StrCmpNIW
StrToIntW
SHDeleteKeyA
StrCatBuffW
PathRemoveFileSpecW
PathRemoveFileSpecA
AssocQueryStringW
PathIsUNCW
PathIsURLW
PathAppendW
StrCpyW

ntdll

RtlCreateAcl
RtlInitializeCriticalSection
RtlUnicodeToOemN
RtlGetNtProductType
NtWaitForSingleObject
RtlCreateSecurityDescriptor
RtlAllocateAndInitializeSid
RtlInitializeResource
RtlFreeAnsiString
RtlSetDaclSecurityDescriptor
NtQuerySystemTime
_wcsnicmp
NtOpenKey
NtQueryVolumeInformationFile
NtWriteFile
RtlFreeHeap
NtCreateEvent
RtlOemStringToUnicodeString
RtlEnterCriticalSection
NtSetInformationThread
RtlReleaseResource
RtlDosPathNameToNtPathName_U
RtlLengthRequiredSid
wcslen
NtCreateFile
RtlDeleteCriticalSection
_stricmp
NtDeviceIoControlFile
DbgPrint

advapi32

RegEnumKeyExW
FreeSid
RegFlushKey
RegEnumKeyExA
ChangeServiceConfig2A
EqualSid
LookupAccountSidW
RegQueryValueExW
GetSecurityDescriptorControl
ChangeServiceConfigA
RegEnumValueW
RegQueryValueExA
RegDeleteKeyW
RegOpenKeyExA
RegEnumValueA
InitializeSecurityDescriptor
RegQueryInfoKeyW
RegOpenKeyExW
AllocateAndInitializeSid
RegDeleteValueW
RegOpenKeyW
RegCloseKey
RegCreateKeyExA
LockServiceDatabase
RegDeleteKeyA
RegDeleteValueA
RegQueryValueW
LookupPrivilegeValueA
RegCreateKeyExW
EnumServicesStatusExA

Sections

.text
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 201KB - Virtual size: 292KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: 35KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 462B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5da23f3498aea8fce475641ba7a2fde4

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

gdi32

user32

comdlg32

msvcrt

version

kernel32

shlwapi

ntdll

advapi32

Sections

.text Size: 33KB - Virtual size: 33KB

.data Size: 3KB - Virtual size: 2KB

.rdata Size: 201KB - Virtual size: 292KB

.adata Size: 35KB - Virtual size: 126KB

.reloc Size: 512B - Virtual size: 462B

.text
Size: 33KB - Virtual size: 33KB

.data
Size: 3KB - Virtual size: 2KB

.rdata
Size: 201KB - Virtual size: 292KB

.adata
Size: 35KB - Virtual size: 126KB

.reloc
Size: 512B - Virtual size: 462B