68795e61ad7860f8657edd0321b871f6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

68795e61ad7860f8657edd0321b871f6_JaffaCakes118
Size

565KB
MD5

68795e61ad7860f8657edd0321b871f6
SHA1

6375518bffb681e5052120abaef21a436b213ac9
SHA256

25526c4873ca639bcc594bd26a1171f1035173af76391fe930e80c80ce25a012
SHA512

2d9711bec1c18578e9b872cdcdedb71353aba0cb260cf802352331f3afe515c88211e7aefc76ad684f79cd63bd8e5fcdc0b37e9520378ec05b6b50417c1cfe0d
SSDEEP

12288:dGD515IdxG5gnR4SolhZ1ANNfFViNbiUOm/MHS6Oy7seJUweA:dezpgnR4SMhLYNfF6OUjMy6C8d

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
68795e61ad7860f8657edd0321b871f6_JaffaCakes118

Files

68795e61ad7860f8657edd0321b871f6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

053029425128143c654864f326ef7e3c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnumCalendarInfoW
SuspendThread
GlobalReAlloc
IsBadReadPtr
lstrcmpiW
WritePrivateProfileStructA
GetFileType
GetBinaryTypeW
UnmapViewOfFile
GetModuleHandleA
GetFileAttributesA
SetVolumeLabelA
GetSystemDefaultLangID
SetSystemTime
VirtualAllocEx
OpenFile
ReadConsoleOutputA
GetCommandLineW
FindResourceExA
WritePrivateProfileSectionA
GetPrivateProfileStringA
VirtualFree
GenerateConsoleCtrlEvent
lstrcatW
ReadFile
LocalReAlloc
EnumResourceNamesA
FindFirstFileW
CreateDirectoryExA
GetModuleFileNameW
GlobalDeleteAtom
CreateMutexW
GetVolumeInformationW
GetSystemTimeAsFileTime
SetMailslotInfo
_llseek
SetConsoleMode
GetComputerNameW
SetConsoleCursorPosition
ConnectNamedPipe
FileTimeToLocalFileTime
GetTapeParameters
SizeofResource
GetCurrentDirectoryW
SetProcessAffinityMask
ExitProcess
CreateMutexA
SearchPathW
IsDBCSLeadByteEx
WriteProcessMemory
WriteConsoleOutputW
FillConsoleOutputCharacterA
GlobalAddAtomA
LocalLock
VirtualLock
GetDriveTypeW
GetEnvironmentStringsW
UnhandledExceptionFilter

comctl32

ord17
ImageList_SetDragCursorImage
PropertySheetA
ImageList_Replace

ole32

CoTaskMemRealloc
StringFromGUID2
CoGetTreatAsClass
OleQueryLinkFromData

user32

InvalidateRect
DestroyIcon
CharToOemBuffA
GetClipboardData
LoadCursorFromFileW
CheckMenuRadioItem
GetClassInfoExW
FindWindowA
CopyAcceleratorTableW
CharLowerA
SetClassLongW
PostQuitMessage
FlashWindow
DrawTextW
IsDialogMessageW
SetKeyboardState
SetProcessDefaultLayout
SetWindowsHookW
ToAscii
SendMessageTimeoutW
SendNotifyMessageA
MonitorFromRect
GetKeyNameTextW
DialogBoxParamW
ChangeMenuA
DragDetect
SetDlgItemInt

version

GetFileVersionInfoSizeA
VerFindFileA
VerInstallFileA

gdi32

GetTextExtentPointA
GetDIBColorTable
EqualRgn
CreateMetaFileW
GetTextCharsetInfo
FrameRgn
SetBkColor
WidenPath

msvcrt

_stricmp
_chsize
wcsncat
vfwprintf
remove
_strnicmp
iswxdigit
_snwprintf
_mbsnextc

Sections

.text
Size: 14KB - Virtual size: 230KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 512B - Virtual size: 18B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 291KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

053029425128143c654864f326ef7e3c

Headers

File Characteristics

Imports

kernel32

comctl32

ole32

user32

version

gdi32

msvcrt

Sections

.text Size: 14KB - Virtual size: 230KB

.text Size: 512B - Virtual size: 18B

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 291KB - Virtual size: 290KB

.rsrc Size: 16KB - Virtual size: 16KB

.text
Size: 14KB - Virtual size: 230KB

.text
Size: 512B - Virtual size: 18B

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 291KB - Virtual size: 290KB

.rsrc
Size: 16KB - Virtual size: 16KB