9672eda85fd6d5af3847aa0d66ca0d36_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

9672eda85fd6d5af3847aa0d66ca0d36_JaffaCakes118
Size

171KB
MD5

9672eda85fd6d5af3847aa0d66ca0d36
SHA1

f14e2d16675a53872cfa7d905eff697f5e7d8171
SHA256

d880bdc2017634cc3c4bcfd4d6f138739314ff1f2698545e0dd392068200e4f7
SHA512

5fdce3c27dc4fdd14b3a2c5b1b6a4a17a7bf7c1e8ca96615403d882787c4cc378046881d6b4c2b89b2af784ac412e497da7aedd913205fd5ee4d13897a67a548
SSDEEP

3072:vgZaMid+wvyonOw+0hUDTljKjG3UTpTy6X8C96RkcH3SGcv6ZrH4dtpxz9iwLwzw:ocMidDyi+0hgT8G3mpTy6X8C961D94ft

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9672eda85fd6d5af3847aa0d66ca0d36_JaffaCakes118

Files

9672eda85fd6d5af3847aa0d66ca0d36_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1dc879f86b0a3cb5e4a37db68fe42c7a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetKeyState
MessageBoxA
CharNextA
wsprintfW
wsprintfA
CharUpperA
CharLowerA

shlwapi

PathAddBackslashA

msimg32

AlphaBlend
TransparentBlt

kernel32

GetCurrentProcess
RtlUnwind
HeapDestroy
GetOEMCP
GetSystemTime
WaitForSingleObject
HeapFree
LoadLibraryA
GetThreadIOPendingFlag
CreateSemaphoreA
CreateMutexA
CloseHandle
TlsSetValue
EnterCriticalSection
LeaveCriticalSection
WritePrivateProfileStringA
FileTimeToLocalFileTime
HeapReAlloc
GetCurrentThreadId
LCMapStringW
SetPriorityClass
FreeEnvironmentStringsA
SetHandleCount
CreateFileW
SetUnhandledExceptionFilter
IsBadReadPtr
GetStdHandle
GetCommandLineA
GetPriorityClass
IsBadCodePtr
TerminateProcess
LCMapStringA
GetEnvironmentStrings
TransmitCommChar
FlushFileBuffers
ExitProcess
FileTimeToSystemTime
RaiseException
UnmapViewOfFile
GetEnvironmentVariableA
GetFullPathNameW
WideCharToMultiByte
GetStringTypeA
HeapAlloc
GetLastError
UnhandledExceptionFilter
GetModuleHandleA
InterlockedIncrement
GetTempFileNameA
SetEndOfFile
GlobalFree
GetFullPathNameA
SetStdHandle
LoadLibraryW
EnumResourceNamesW
WriteFile
GetProcAddress
CompareStringA
GetThreadPriority
CompareStringW
TlsAlloc
lstrcpyA
SetLastError
GetTempPathW
SetEvent
InterlockedExchange
MultiByteToWideChar
GlobalAlloc
ExitProcess
lstrcmpW
IsDBCSLeadByte
ExitThread
GetTimeZoneInformation
GlobalUnlock
GetACP
TlsGetValue
GetDiskFreeSpaceExA
FreeEnvironmentStringsW
IsBadWritePtr
GetStartupInfoA
InitializeCriticalSection
GetUserDefaultLCID
MapViewOfFile
HeapSize
GetPrivateProfileStringA
DeleteCriticalSection
GetModuleFileNameA
CreateThread
GetEnvironmentStringsW
InterlockedDecrement
ReleaseSemaphore
CreateFileMappingA
Sleep
TlsFree
lstrcmpA
ResetEvent
OutputDebugStringA
GetTickCount
GetFileType
GetCPInfo
GetTempPathA
GetStringTypeW
HeapCreate
FreeLibrary
SetEnvironmentVariableA

advapi32

RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA

Sections

.text
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crt
Size: 512B - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1dc879f86b0a3cb5e4a37db68fe42c7a

Headers

File Characteristics

Imports

user32

shlwapi

msimg32

kernel32

advapi32

Sections

.text Size: 138KB - Virtual size: 137KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 28KB - Virtual size: 28KB

.crt Size: 512B - Virtual size: 216KB

.text
Size: 138KB - Virtual size: 137KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 28KB - Virtual size: 28KB

.crt
Size: 512B - Virtual size: 216KB