af1e3b35af7da25d9fd8ce234bf0ccab_JaffaCakes118

General

Target

af1e3b35af7da25d9fd8ce234bf0ccab_JaffaCakes118
Size

220KB
MD5

af1e3b35af7da25d9fd8ce234bf0ccab
SHA1

7110ca924a9d19a4a22ae6aa51affa5dce28132c
SHA256

a6f761c1d56a5ec649a5046345883f6338ca545cd8ef65f84682d5ac66fc7d7e
SHA512

0f3d7ae017344ec8c072b57dacd76c3288a8ab64fb77192f77f45e9494c9a4914584e25dd251a7c6c6aa5ce5c0370c2d06735ae0db9f1f46fca8131d6c68eead
SSDEEP

6144:9bAOO7/nl6AKOuW2HmGuWMWcp1ah4tpr8iGr:9bne4AKOuW2HmGuWMWusgprxU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af1e3b35af7da25d9fd8ce234bf0ccab_JaffaCakes118

Files

af1e3b35af7da25d9fd8ce234bf0ccab_JaffaCakes118
.exe windows:4 windows x86 arch:x86

15c2604800da51532839d0322ac548cc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
FindClose
GetCurrentProcess
GetCurrentProcessId
DeleteTimerQueue
VirtualLock
GetCommandLineA
GetTempPathA
Sleep
VirtualProtect
LoadLibraryA
GetProcAddress
OpenSemaphoreA
GetModuleHandleA
WaitForMultipleObjects
GetModuleFileNameA
ReleaseSemaphore
lstrcpyA
VirtualFree
TlsGetValue
GetPriorityClass
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
HeapSize
VirtualQuery
InterlockedExchange
RtlUnwind
GetLastError
ResetEvent
CreateEventA
GetSystemInfo
HeapReAlloc
HeapAlloc
GetCPInfo
GetOEMCP
GetStartupInfoA
GetVersionExA
ExitProcess
TerminateProcess
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
HeapFree
GetACP

user32

IsWindowUnicode
IsWindowVisible
LoadCursorA
GetDesktopWindow
GetDC
ReleaseDC
CreateIcon
IsIconic
SetCursorPos
GetWindowRect
SetCursor
InSendMessage
SetTimer
GetCursorPos

gdi32

SelectObject
FloodFill

shell32

ord256
SHFileOperationA

psapi

EnumProcessModules

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 156KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

15c2604800da51532839d0322ac548cc

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

psapi

Sections

.text Size: 20KB - Virtual size: 16KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 32KB - Virtual size: 32KB

.rsrc Size: 156KB - Virtual size: 154KB

.text
Size: 20KB - Virtual size: 16KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 32KB - Virtual size: 32KB

.rsrc
Size: 156KB - Virtual size: 154KB