85301698a561bd77887c5e7d2b95782c_JaffaCakes118

General

Target

85301698a561bd77887c5e7d2b95782c_JaffaCakes118
Size

165KB
MD5

85301698a561bd77887c5e7d2b95782c
SHA1

863cae4a12708821fb2d3c82815627f02a56570c
SHA256

15341856e034c39c9ef70ad08ba13a0248169bdadf25141456bc3f97b0a74d3b
SHA512

65f0f42e1cf6c43081071eccbfc092c7e0a8bc828a03403bda4f145c9dfb0548e74cae8f2f411e955593cddbabb97c2ebb9ea4d5c2e962df21f975d55745d062
SSDEEP

3072:gmaYFWGGuPbP8ltjBH3oJwWJKGmputhaHdDyV35+hR0gq+dUBgX3ae7Sz7sgpQ:cGxD8ltjBH3oJw0bUAkyVJ0R0f+b6OQX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
85301698a561bd77887c5e7d2b95782c_JaffaCakes118

Files

85301698a561bd77887c5e7d2b95782c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a2bcf2e338ff0b1aba054df6df80b3a5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

DispatchMessageA
TranslateMessage
PostMessageA
SendMessageA
PeekMessageA
wsprintfA

kernel32

GetThreadLocale
ProcessIdToSessionId
GetCurrentProcess
DosPathToSessionPathW
InterlockedIncrement
GetDiskFreeSpaceExW
GetACP
GetCurrentThreadId
FreeLibrary
lstrlenA
InterlockedDecrement
GetProcessId
GetTickCount
WideCharToMultiByte
InitializeCriticalSection
SetProcessAffinityMask
QueryPerformanceCounter
CreateFileW
EnumResourceTypesA
GetLocalTime
WaitForSingleObject
GetVolumeInformationW
GetModuleFileNameA
GetLastError
GetFileSize
GetCurrentProcessId
GetLocaleInfoA
DisableThreadLibraryCalls
DeleteFileW
ExitProcess
InterlockedExchange
GetProcessAffinityMask
GetSystemTimeAsFileTime
MultiByteToWideChar
CloseHandle
GetVersionExA
DeleteCriticalSection
DeleteFileA

ole32

CoTaskMemFree
CoTaskMemAlloc
CoFreeUnusedLibraries
CoCreateInstance
StringFromGUID2
CoInitialize
CoUninitialize

advapi32

RegEnumKeyExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueA
RegCreateKeyA
RegSetValueExA
RegCloseKey

gdiplus

GdipCreateHBITMAPFromBitmap
GdipCloneImage

Sections

.text
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a2bcf2e338ff0b1aba054df6df80b3a5

Headers

File Characteristics

Imports

user32

kernel32

ole32

advapi32

gdiplus

Sections

.text Size: 98KB - Virtual size: 97KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 63KB - Virtual size: 62KB

.tls Size: 1024B - Virtual size: 92KB

.text
Size: 98KB - Virtual size: 97KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 63KB - Virtual size: 62KB

.tls
Size: 1024B - Virtual size: 92KB