a42e69ee22972606a044d9f516d71264_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a42e69ee22972606a044d9f516d71264_JaffaCakes118
Size

38KB
MD5

a42e69ee22972606a044d9f516d71264
SHA1

1567a05f4d54dd50bbb4793387578a0a165885f4
SHA256

020ead9a1ebee99b08b504cc1ecb854516a177c46d35d405726a71e9c9bc2507
SHA512

84a18a8a9961d285c215ef53068bdc630a6dc8802bfeaed8a9eaf302ab340b44c4ab2b1306777cba1f3d67c5a7b6491797dc9c996594a86f2b54ab573539046c
SSDEEP

768:hHpV+r8UaxFF6+FFT+CtNhZ/KloJsaIkXWOcobfEYuM1noQbMGhKu:hf+r8UaxFpFT+CtNSo5XWPCfEYB9jKu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a42e69ee22972606a044d9f516d71264_JaffaCakes118

Files

a42e69ee22972606a044d9f516d71264_JaffaCakes118
.exe .vbs windows:4 windows x86 arch:x86 polyglot

3a406257d99ca28b4628eff78ebf1a3b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Proj KL4.0(29.03.09)\KL\Release\KLv4.0.pdb

Imports

kernel32

CloseHandle
HeapAlloc
GetFileSize
CreateFileA
WriteFile
lstrlenA
SetFilePointer
lstrcatA
GetLocalTime
lstrcmpA
GetCurrentThreadId
lstrcpyA
GetModuleHandleA
GlobalUnlock
GlobalLock
CreateThread
GetModuleFileNameA
GetLastError
CreateMutexA
HeapCreate
HeapDestroy
GetWindowsDirectoryA
GetSystemDirectoryA
DeleteFileA
ReadFile
FindClose
FindNextFileA
FindFirstFileA
SetCurrentDirectoryA
CompareStringA
GetExitCodeProcess
CreateProcessA
LockResource
LoadResource
SizeofResource
FindResourceA
GetEnvironmentVariableA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetVersionExA
SetFileAttributesA
RemoveDirectoryA
SetLastError
GetFileAttributesA
lstrcmpiA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
Sleep
RtlUnwind

user32

PostQuitMessage
ChangeClipboardChain
CloseClipboard
GetClipboardData
OpenClipboard
SendMessageA
DispatchMessageA
TranslateMessage
IsDialogMessageA
SetWindowsHookExA
GetMessageA
SetClipboardViewer
CreateDialogParamA
CharLowerA
EnumChildWindows
GetWindowThreadProcessId
GetKeyboardLayout
AttachThreadInput
UnhookWindowsHookEx
IsWindow
GetKeyboardState
ToAsciiEx
GetWindowTextA
wsprintfA
CallNextHookEx
GetForegroundWindow

advapi32

RegQueryValueExA
RegOpenKeyA

shell32

ShellExecuteA

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3a406257d99ca28b4628eff78ebf1a3b

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

Sections

.text Size: 11KB - Virtual size: 11KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 1KB

.CRT Size: 512B - Virtual size: 8B

.rsrc Size: 21KB - Virtual size: 20KB

.text
Size: 11KB - Virtual size: 11KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 8B

.rsrc
Size: 21KB - Virtual size: 20KB