9505e16058a6b51164ac28dcb2960574_JaffaCakes118

General

Target

9505e16058a6b51164ac28dcb2960574_JaffaCakes118
Size

173KB
MD5

9505e16058a6b51164ac28dcb2960574
SHA1

a95831b3a9e2ebe9a106f43ccea41097198a8419
SHA256

68c27d7aa774164e5d37e3416250bf40b547853987722d9b1d2806f39f0d9c4a
SHA512

db26488482d097a89b79af048d1fe69ad0cb4a0a6c564cf00240aa6496fcc37176731622a0ca34610a11e9be8001fa200a2b07ddb8e5eaec4030b352c74aa5f4
SSDEEP

3072:tpmM5dGRZDPZItiRvOfnBedl6erPjDqzT+tkIBdtClbYQ9sTx62ZoWZK7/vZFPM:1cxZItiRvOZOl64P6X+tj38lbX9sTzvw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9505e16058a6b51164ac28dcb2960574_JaffaCakes118

Files

9505e16058a6b51164ac28dcb2960574_JaffaCakes118
.exe windows:5 windows x86 arch:x86

4d8e54019b7f3ea3129b0518c444d67f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

btcheftp

_Tolower
_LExp
_LPoly
_LInf
_FEps
_FExp
_LSnan
_Denorm
_FDnorm
_Getctype

ntdll

NtOpenMutant
NtOpenSemaphore
NtPulseEvent
NtOpenEventPair
NtClose
NtOpenMutant
NtQuerySystemTime

shell32

DragQueryFileW
SHGetSpecialFolderLocation

user32

SetTimer
LoadCursorW
EnableWindow
ModifyMenuW
RegisterWindowMessageW
GetActiveWindow
DrawTextW
SetDlgItemTextW
DrawTextA
FindWindowW
GetFocus
GetWindowLongW
EnableMenuItem
GetDlgCtrlID
GetMenuItemID
DefWindowProcW
GetDesktopWindow
SetMenuItemInfoW
GetWindowRect
GetMessagePos
GetCursorPos
RegisterClassExW
MoveWindow
GetWindowTextLengthW
CloseClipboard
LoadImageW

gdi32

CreateFontIndirectW
AddFontResourceW
CreateBitmap

kernel32

LocalAlloc
ReadDirectoryChangesW
WaitForSingleObject
GetPriorityClass
LocalFree
SetLastError
DeleteCriticalSection
GlobalAlloc
SleepEx
GetLocaleInfoW
VirtualProtect
GetCurrentThread
CreateThread
CompareStringW
FlushInstructionCache
InterlockedExchangeAdd
CloseHandle
GetModuleHandleA
lstrcmpiW

msvcrt

qsort
wcstol
memcpy
_controlfp
_wfopen

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4d8e54019b7f3ea3129b0518c444d67f

Headers

DLL Characteristics

File Characteristics

Imports

btcheftp

ntdll

shell32

user32

gdi32

kernel32

msvcrt

Sections

.text Size: 15KB - Virtual size: 15KB

.data Size: 37KB - Virtual size: 36KB

.rsrc Size: 120KB - Virtual size: 120KB

.text
Size: 15KB - Virtual size: 15KB

.data
Size: 37KB - Virtual size: 36KB

.rsrc
Size: 120KB - Virtual size: 120KB