9fca66df37ddc609b4f6a0db0fa39dc2_JaffaCakes118

General

Target

9fca66df37ddc609b4f6a0db0fa39dc2_JaffaCakes118
Size

580KB
MD5

9fca66df37ddc609b4f6a0db0fa39dc2
SHA1

546c208c9c7ea7611a171780dd00631cd6422709
SHA256

d313b9b6fd664a920a093da2fa0dd2da845eab90dcfd1be71abd4cefd1d058c1
SHA512

e4eaf057f163e293ab9099d6a58667469aad4db2cf066a1025e8271d652f610e56bd9f001d76244a72bcadb41b6c2ca503d8ff87e886aa1e6d92ae41093670c4
SSDEEP

12288:B09pxGVFh0CVMPE+PdeJTZAbW9tuKc4yxqXr7bFdm5Uf01p8kzVm:Bopx4Fh0CVMPNPd8RruKc4wqXjFM5Uc2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9fca66df37ddc609b4f6a0db0fa39dc2_JaffaCakes118

Files

9fca66df37ddc609b4f6a0db0fa39dc2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bce822dd8b1a90ae570064feed0def24

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

malloc
free
modf
memmove
_CIpow
_CIfmod
_ftol
atoi
sprintf
_strnicmp
strncmp
??3@YAXPAX@Z
strncpy

user32

PeekMessageA
wsprintfA
SetWindowPos
SetWindowLongA
GetWindowLongA
CallWindowProcA
SetFocus
PostQuitMessage
DefWindowProcA
RegisterClassExA
LoadCursorA
LoadIconA
SendMessageA
CreateWindowExA
CloseClipboard
EnableWindow
MapWindowPoints
GetParent
GetWindowRect
MoveWindow
SetWindowTextA
GetWindowTextA
GetWindowTextLengthA
IsWindow
UpdateWindow
ShowWindow
IsWindowVisible
DispatchMessageA
TranslateMessage
EmptyClipboard
OpenClipboard
GetSystemMetrics
IsWindowEnabled
GetMessageA
MessageBoxA
SetClipboardData

kernel32

Process32First
Process32Next
CloseHandle
OpenProcess
VirtualAllocEx
CreateToolhelp32Snapshot
CreateRemoteThread
LoadLibraryA
GetProcAddress
GetComputerNameA
lstrcpyn
WriteProcessMemory
CreateFileA
LCMapStringA
GetVersionExA
GlobalAlloc
GlobalLock
GlobalUnlock
GetStartupInfoA
CreateProcessA
WaitForSingleObject
GetModuleHandleA
WriteFile
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
ReadProcessMemory
GetCurrentProcess
RtlMoveMemory

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation

shlwapi

PathIsDirectoryA

comctl32

ord17

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 516KB - Virtual size: 562KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bce822dd8b1a90ae570064feed0def24

Headers

File Characteristics

Imports

msvcrt

user32

kernel32

shell32

shlwapi

comctl32

Sections

.text Size: 48KB - Virtual size: 47KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 516KB - Virtual size: 562KB

.rsrc Size: 8KB - Virtual size: 4KB

.text
Size: 48KB - Virtual size: 47KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 516KB - Virtual size: 562KB

.rsrc
Size: 8KB - Virtual size: 4KB