960f54e2e6a7b65c2b4c723c635d6bd6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

960f54e2e6a7b65c2b4c723c635d6bd6_JaffaCakes118
Size

180KB
MD5

960f54e2e6a7b65c2b4c723c635d6bd6
SHA1

606517bee35719de28266e88f7393ea6a0f1413f
SHA256

d0c30ef0e0f4aa4ce42929c1e28c75494e621853e200db99339403d7738fa6a3
SHA512

a8ff4c2d513b39e15defa8677c42551272e9c3a7f5f46d44536651a1a8584827d4b018caf1151edd85fb5f36fc920a2dc83c9b39850938ce5d99fb1190254a91
SSDEEP

3072:5T9n02SlVU6NXYWDeKgsvPmDno/HaLi/M8UlZDlYIBJTlknVK90RL8/DyVgR8LV1:5Tp9GVJNXYWyKJP9Cm/MdYIBJTlUImgk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
960f54e2e6a7b65c2b4c723c635d6bd6_JaffaCakes118

Files

960f54e2e6a7b65c2b4c723c635d6bd6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f29811b7fb8d6a0f40e75cd26a51e273

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

quartz

AMGetErrorTextW

shell32

SHGetSpecialFolderPathA

user32

RegisterWindowMessageA
wvsprintfA
GetQueueStatus
wsprintfA
RegisterClassA
GetMessageA
DispatchMessageA
MonitorFromWindow
PeekMessageA
CopyRect
MsgWaitForMultipleObjects
CreateWindowExA
LoadStringA
PostThreadMessageA
DestroyWindow

winmm

timeBeginPeriod
timeGetDevCaps
timeGetTime
timeEndPeriod

kernel32

GetACP
DeleteCriticalSection
GetSystemInfo
WaitForMultipleObjects
LeaveCriticalSection
GetThreadPriority
CreateThread
GetTapeParameters
GlobalAlloc
GetProcAddress
GetVersionExA
CreateSemaphoreA
WaitForSingleObject
ClearCommError
IsBadReadPtr
IsBadWritePtr
CloseHandle
MultiByteToWideChar
InterlockedDecrement
EnterCriticalSection
CreateFileW
SetEvent
VirtualAlloc
CreateEventA
LocalFree
LockResource
HeapFree
lstrlenA
LoadLibraryW
EnumResourceNamesA
ReleaseMutex
GetProcessHeap
GetTickCount
GetModuleFileNameW
LoadResource
GetExitCodeThread
DisableThreadLibraryCalls
ReleaseSemaphore
ResetEvent
FatalExit
VirtualFree
GetSystemTime
LoadLibraryA
Sleep
GetSystemTimeAsFileTime
FindResourceA
CreateMutexA
WideCharToMultiByte
GetCurrentThread
QueryPerformanceCounter
InitializeCriticalSection
GetModuleFileNameA
TerminateThread
GetCurrentProcessId
ResumeThread
FreeLibrary
SetThreadPriority
GetLastError
InterlockedIncrement
GetCurrentThreadId
ExitProcess

advapi32

RegSetValueExA
RegCreateKeyA
RegSetValueA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegEnumKeyExA

ole32

CoTaskMemFree
StringFromCLSID
GetRunningObjectTable
CoInitialize
CoRevokeClassObject
CLSIDFromString
CoCreateInstance
CreateItemMoniker
CoUninitialize
StringFromGUID2
CoInitializeEx
CoFreeUnusedLibraries
CoRegisterClassObject
CreateStreamOnHGlobal
CoTaskMemAlloc

Sections

.text
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.lib
Size: 512B - Virtual size: 364KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f29811b7fb8d6a0f40e75cd26a51e273

Headers

File Characteristics

Imports

quartz

shell32

user32

winmm

kernel32

advapi32

ole32

Sections

.text Size: 121KB - Virtual size: 121KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 53KB - Virtual size: 53KB

.lib Size: 512B - Virtual size: 364KB

.text
Size: 121KB - Virtual size: 121KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 53KB - Virtual size: 53KB

.lib
Size: 512B - Virtual size: 364KB