a22c142e9d2b6db02815b7f6112c1158_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a22c142e9d2b6db02815b7f6112c1158_JaffaCakes118
Size

125KB
MD5

a22c142e9d2b6db02815b7f6112c1158
SHA1

650ffd632cddaf435531a36ff03579a94bb1ec5f
SHA256

a749cce9f37e3062db6070960207f98cd0744854387c685cb94ff0881f6b65f4
SHA512

e4c0976c61e09705058e3e65f05dcc0bb80b9032015f46c1b97875b5b53a9258b3daf13f4d71c3c138b6807cc324668cf7a0300fd0e428c788572cb9380dc55f
SSDEEP

1536:F5e0OWZ97rMIlGbrugyBRU8LLtZ9ALyBO5LkfsZYPQWA7oRpwGWiZ:7eD6larugyXBljAEKkUy+7on

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a22c142e9d2b6db02815b7f6112c1158_JaffaCakes118

Files

a22c142e9d2b6db02815b7f6112c1158_JaffaCakes118
.exe windows:5 windows x86 arch:x86

7d49bb5113c148bcf7dbefe2e3f17f09

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

X:\pHrX\uqqtIls\kzcswoqz\zpif.pdb

Imports

gdi32

CreateFontIndirectA
TextOutW
CreatePolygonRgn
CreateBrushIndirect
EndDoc
SetBitmapDimensionEx

kernel32

SetCommMask
TlsGetValue
lstrcmpiW
TryEnterCriticalSection
FreeResource
InterlockedExchangeAdd
GetUserDefaultUILanguage
GetCurrentProcessId
InterlockedExchange
ExitProcess
SetFileAttributesW

ntdll

memset
_stricmp

shlwapi

PathMakePrettyW
StrSpnA

user32

CharUpperBuffA
GrayStringW
GetActiveWindow
GetWindowLongA
IsZoomed
RedrawWindow
GetWindowDC
DrawMenuBar
OffsetRect
ChangeMenuW
DialogBoxParamA
SetWindowPos
LoadBitmapW

Exports

Exports

?prtsxftj_I@@YGIPAIPAE@Z
?_ngXZNQQjUBPQX_Xehlg_K@@YGKPAJ@Z
?gmi_oxO_Oia__v@@YGXH@Z
?owf_rkz_x_sx_iru_@@YGXG@Z
?Y_Pjz__ee_sfj@@YGEPAMF@Z
?_BMDN_ZF_Esc_V@@YGXPAHH@Z
?FU_P__VXKX_dnvSOF@@YGNIK@Z
?yqkih__@@YGPAJEPAJ@Z

Sections

.code
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 66KB - Virtual size: 397KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 422B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.import
Size: 1024B - Virtual size: 910B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7d49bb5113c148bcf7dbefe2e3f17f09

Headers

File Characteristics

PDB Paths

Imports

gdi32

kernel32

ntdll

shlwapi

user32

Exports

Exports

Sections

.code Size: 23KB - Virtual size: 23KB

.data Size: 66KB - Virtual size: 397KB

.rdata Size: 24KB - Virtual size: 24KB

.edata Size: 512B - Virtual size: 422B

.import Size: 1024B - Virtual size: 910B

.rsrc Size: 6KB - Virtual size: 8KB

.reloc Size: 2KB - Virtual size: 1KB

.code
Size: 23KB - Virtual size: 23KB

.data
Size: 66KB - Virtual size: 397KB

.rdata
Size: 24KB - Virtual size: 24KB

.edata
Size: 512B - Virtual size: 422B

.import
Size: 1024B - Virtual size: 910B

.rsrc
Size: 6KB - Virtual size: 8KB

.reloc
Size: 2KB - Virtual size: 1KB