8e406840e8b0b72fe659d14ffb18ef63_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8e406840e8b0b72fe659d14ffb18ef63_JaffaCakes118
Size

172KB
MD5

8e406840e8b0b72fe659d14ffb18ef63
SHA1

686d82abe646b9ec6d9d99aebe551d6b937d97c8
SHA256

17f6c6816e23c992594bed7f73b7c9b8b7c5185cbd4b5730c12f3a506443a387
SHA512

78a121726fe2de822adb79a0633230bee32d8739ea38cd0de8f28d6ca460ff8ffe9e145cf971f3d52ddfd25cbc17d0c85554a6fb083f733c6c4005ef4fab08d6
SSDEEP

3072:HznXWjhacQCw6H4T1KVTsT+BXZT6j/1JCT+5dLZnReEimVvfuO4quyIwteSX:TXWRNwF16TsT+KjNJCwdlnRNGnqu4eI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e406840e8b0b72fe659d14ffb18ef63_JaffaCakes118

Files

8e406840e8b0b72fe659d14ffb18ef63_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8c12c9c20a8776ea26c691f7965f2be8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHGetSpecialFolderPathA

gdi32

GetObjectA
StretchBlt
CreateCompatibleDC
SelectObject
CreateDCA
CreateDIBSection
GetStockObject
BitBlt
DeleteDC
PatBlt
SetStretchBltMode
DeleteObject
CreateCompatibleBitmap
SetDIBits

user32

ReleaseDC
DispatchMessageA
SetParent
CopyRect
EqualRect
AttachThreadInput
InvalidateRect
RegisterClassA
PostMessageA
SendMessageA
GetDC
IsWindow
DefWindowProcA
FillRect
wsprintfA
PeekMessageA
GetDesktopWindow
SetRect
BringWindowToTop
TranslateMessage
GetClientRect
EnableWindow
InflateRect
UnregisterClassA

avifil32

AVISaveOptions
AVIMakeCompressedStream

advapi32

RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCreateKeyExA
RegOpenKeyExW
RegSetValueA
RegCreateKeyA
RegDeleteKeyA
RegCloseKey
RegSetValueExA

kernel32

CloseHandle
ReadFile
DeleteCriticalSection
WaitForMultipleObjectsEx
GetCurrentThreadId
MultiByteToWideChar
GetVersionExA
GetFileAttributesA
InitializeCriticalSection
CreateDirectoryA
SetFilePointer
GlobalLock
GlobalFree
GetTickCount
CreateMutexA
GetLastError
GetCurrentProcessId
Sleep
GetProcessId
GetSystemTimeAsFileTime
GetModuleFileNameW
DisableThreadLibraryCalls
VirtualFree
WaitForSingleObject
lstrlenA
GetVolumeInformationA
EnumResourceTypesW
CopyFileA
CreateFileA
QueryPerformanceCounter
GetSystemTime
WideCharToMultiByte
VirtualAlloc
LocalFree
CreateFileW
GlobalUnlock
ExitProcess
ReleaseMutex
LocalAlloc
GetTempFileNameA
GetModuleFileNameA
DeviceIoControl
GetTempPathA
DeleteFileA
GetFileSize
SetFileAttributesA
InterlockedIncrement
InterlockedDecrement
FreeLibrary

shlwapi

PathFileExistsW
PathFileExistsA
StrStrIW

ole32

CreateItemMoniker
StringFromGUID2
GetRunningObjectTable
CoCreateInstance
CoSetProxyBlanket
CoUninitialize
StgOpenStorage
CoTaskMemAlloc
StgCreateDocfile
CoFreeUnusedLibraries
CoInitialize
CoTaskMemFree

Sections

.text
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8c12c9c20a8776ea26c691f7965f2be8

Headers

File Characteristics

Imports

shell32

gdi32

user32

avifil32

advapi32

kernel32

shlwapi

ole32

Sections

.text Size: 98KB - Virtual size: 98KB

.rdata Size: 3KB - Virtual size: 3KB

.bss Size: 68KB - Virtual size: 67KB

.tls Size: 1024B - Virtual size: 256KB

.text
Size: 98KB - Virtual size: 98KB

.rdata
Size: 3KB - Virtual size: 3KB

.bss
Size: 68KB - Virtual size: 67KB

.tls
Size: 1024B - Virtual size: 256KB