8e103b37f887219ae6024bec8645bd1e_JaffaCakes118

General

Target

8e103b37f887219ae6024bec8645bd1e_JaffaCakes118
Size

561KB
MD5

8e103b37f887219ae6024bec8645bd1e
SHA1

2d7c8ca8eaea91e11d2295d91edc31433c719695
SHA256

32fc1b5f0d878e82b97bfc5500b7c464488cf16f9105760fd9bb9a183166cc4a
SHA512

d111c841773f7bf85c2d8269bfa7417273e72e521c6a7d4b6ff636fd0f65433be8cda53c042feadac1573c5536f2bc3238c90d3ebe79fe9e039d063a27ec0ef9
SSDEEP

12288:2hJlUAmnC5XDjKX50M7cCvPvNOicM1vz5SdmiUr69zZQ:0JlUAdF/I5Rt3vNOicM1v9SdkrAO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e103b37f887219ae6024bec8645bd1e_JaffaCakes118

Files

8e103b37f887219ae6024bec8645bd1e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

61a2ac557d283fec0a930f706dcbe150

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CryptDestroyHash
CryptReleaseContext
RegEnumKeyExA
RegQueryValueExA
RegCloseKey
CryptHashData
CryptAcquireContextW
CryptCreateHash
RegDeleteValueA
RegCreateKeyExA
CryptGetHashParam
RegSetValueExA
GetUserNameW

shlwapi

PathFindFileNameW
StrCmpNIW
PathCombineW
SHDeleteKeyA
StrCmpNIA
PathMatchSpecW
wnsprintfW
wvnsprintfW
wvnsprintfA
wnsprintfA

user32

SetProcessWindowStation
ToUnicode
MsgWaitForMultipleObjects
GetCursorPos
GetIconInfo
GetClassNameA
GetKeyState
FindWindowExA
GetDlgItemTextA
PeekMessageA
SetThreadDesktop
CloseWindowStation

kernel32

GetModuleHandleA
ReleaseMutex
WaitForSingleObject
SystemTimeToFileTime
LoadLibraryA
VirtualAlloc
VirtualProtect
Sleep
GlobalUnlock
GetUserDefaultUILanguage
CreateProcessW
GetLocalTime
GetDiskFreeSpaceW
CreateFileA
GetTimeZoneInformation
InitializeCriticalSection
GetAtomNameW
GetEnvironmentVariableW
lstrcmpiA
GetModuleFileNameW
lstrcpynW

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

61a2ac557d283fec0a930f706dcbe150

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shlwapi

user32

kernel32

Sections

.text Size: 55KB - Virtual size: 55KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 24KB

.text
Size: 55KB - Virtual size: 55KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 24KB