abb0241aa340f638f045db52eb058c04_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

abb0241aa340f638f045db52eb058c04_JaffaCakes118
Size

117KB
MD5

abb0241aa340f638f045db52eb058c04
SHA1

89e4dd0e7a64baddefd5480747466a00e17beb28
SHA256

a72ba8aef4fcc45ff78a85b502b8f860c92292d767827f98b911b5cc11aaf4e3
SHA512

66756dd65dc6e1a19dc8519015d6cfc22934f97837dfc5a123587bd19764b1a522e5397dd288480d02ddfeeb0a9ce365f140007aa6ae34270295c26ea5b5d80a
SSDEEP

3072:5h8nRhPDnxmi4VBCof8wpY/fsa+VaRk3wqNXRIRJJHdwfKRM7URpG:PEFnxgBz5pKn+ULqNXRIRJ0i3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
abb0241aa340f638f045db52eb058c04_JaffaCakes118

Files

abb0241aa340f638f045db52eb058c04_JaffaCakes118
.exe windows:5 windows x86 arch:x86

0e56fd3ecf61559a16ae6e1f32fcc39b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

O:\ywed\yeZN\uStsMgKo\yxAit\DGcPgrzn.pdb

Imports

shlwapi

StrNCatW

user32

DragObject
TranslateMessage
SystemParametersInfoW
DefDlgProcW
IsCharUpperA
GetParent
TranslateAcceleratorA
CreateDialogParamA
GetClassLongA
DestroyWindow
GetDialogBaseUnits
DeleteMenu
CharNextExA
IsRectEmpty
GetClientRect
CharToOemW
CreateDialogIndirectParamW
InSendMessageEx
CallWindowProcW
SetWindowTextA
AppendMenuW
GetCapture
IsZoomed
GetWindowTextA
SetScrollPos
SetWindowPlacement
SetMenuItemBitmaps
CharToOemBuffA
ScreenToClient
CreateIconIndirect
SendMessageTimeoutW
IsIconic
GetForegroundWindow
CreateCursor

gdi32

RectInRegion
CreateICW
CreateRoundRectRgn
GetClipBox
GetWindowOrgEx
BeginPath
EnumFontFamiliesW
CreatePen
StretchDIBits
CreateDIBSection
TextOutW
CreatePenIndirect
GetTextMetricsW
FillRgn

comdlg32

ChooseFontW
PageSetupDlgW
GetSaveFileNameW
ChooseColorW
GetSaveFileNameA

kernel32

WaitForMultipleObjectsEx
GetUserDefaultLCID
CancelWaitableTimer
TlsFree
GetComputerNameA
FindResourceA
GetShortPathNameA
EnumSystemLocalesA
CopyFileW
HeapFree
SetEndOfFile
SetCurrentDirectoryA
CreateDirectoryW
GetFullPathNameW
VirtualProtect

comctl32

ImageList_Remove
CreatePropertySheetPageW
ImageList_AddMasked
ImageList_Read
ImageList_GetIcon

Exports

Exports

?_OpenInputDesktop@@YGXEHPAD@Z

Sections

.text
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0e56fd3ecf61559a16ae6e1f32fcc39b

Headers

File Characteristics

PDB Paths

Imports

shlwapi

user32

gdi32

comdlg32

kernel32

comctl32

Exports

Exports

Sections

.text Size: 66KB - Virtual size: 66KB

.rdata Size: - Virtual size: 132KB

.data Size: 25KB - Virtual size: 24KB

.pdata Size: 22KB - Virtual size: 22KB

.rsrc Size: 512B - Virtual size: 16B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 66KB - Virtual size: 66KB

.rdata
Size: - Virtual size: 132KB

.data
Size: 25KB - Virtual size: 24KB

.pdata
Size: 22KB - Virtual size: 22KB

.rsrc
Size: 512B - Virtual size: 16B

.reloc
Size: 1KB - Virtual size: 1KB