b4a6aaea05a939dd8c512259fe73fe00_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b4a6aaea05a939dd8c512259fe73fe00_JaffaCakes118
Size

326KB
MD5

b4a6aaea05a939dd8c512259fe73fe00
SHA1

c4e4ef3125359f87f81f4deb97b62d9a53d8bb09
SHA256

6b3e00b16887a727663574edfdf64f6882aa7111664316f2567d69d887bffc40
SHA512

b18a4beec2213c12ba148a475073fe0ac13622362509685073d686ca41e22b70f790730c8e92f229f841c1cba14db818e9812ab9a368d3999688bd42dacf3d59
SSDEEP

6144:QCpRAj8hb0TSIHo6/n5PFAwYH3qjcGG3Ss3h7xt2G1xTB8T/mVorXMqt:VpRxhb0TDHo6fhFAwgqjTISsR1tOTeKY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b4a6aaea05a939dd8c512259fe73fe00_JaffaCakes118

Files

b4a6aaea05a939dd8c512259fe73fe00_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e27ea0ccc718f2737200411d34aa942d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

kernel32

SetFilePointer
GetUserDefaultUILanguage
GetSystemTimeAsFileTime
TerminateProcess
InterlockedDecrement
LoadLibraryExW
GetModuleFileNameW
LeaveCriticalSection
GetSystemDefaultUILanguage
DeleteAtom
GetProcessHeap
GetPrivateProfileSectionA
GetTickCount
CloseHandle
WritePrivateProfileStringW
FormatMessageW
GetLastError
WideCharToMultiByte
DisableThreadLibraryCalls
CreateFileMappingW
HeapReAlloc
lstrcmpiW
DeleteCriticalSection
lstrlenW
MapViewOfFile
HeapFree
LocalFree
GlobalAlloc
GetFileSize
GetPrivateProfileStringA
GlobalFree
ReadFile
SetUnhandledExceptionFilter
WritePrivateProfileSectionW
MultiByteToWideChar
WritePrivateProfileSectionA
InterlockedCompareExchange
RtlUnwind
WriteFile
SearchPathW
QueryPerformanceCounter
HeapAlloc
InterlockedExchange
FindAtomA
UnmapViewOfFile
InitializeCriticalSection
AddAtomA
GetPrivateProfileStringW
UnhandledExceptionFilter
GetFileAttributesW
EnterCriticalSection
lstrlenA
GetCurrentThreadId
GetVersionExW
GetCurrentProcessId
LocalAlloc
SetLastError
FindResourceExW
CompareStringW
GetCurrentProcess
FreeLibrary
LoadResource
FindResourceW
Sleep
lstrcmpW
CreateFileW
GetPrivateProfileSectionW

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance

ntdll

NtAllocateVirtualMemory

gdi32

GetTextExtentPoint32W
CreateFontIndirectW
GetDeviceCaps
DeleteObject
GetTextMetricsW
SelectObject
GetStockObject

msvcrt

_CxxThrowException
_amsg_exit
_wcsicmp
malloc
memcpy
free
_vsnwprintf
memset
_initterm
bsearch
_adjust_fdiv
_XcptFilter
_wcsnicmp

shlwapi

PathFindFileNameW
StrCmpNW
StrToIntW
StrCmpW
StrCmpIW
StrDupW
StrCSpnW
StrRChrW
StrSpnW

samlib

SamAddMemberToAlias

user32

SetDlgItemTextW
GetDlgItemTextW
ReleaseDC
SetWindowPos
LoadCursorW
EndDialog
UnregisterClassA
CallWindowProcW
SetWindowTextW
DefWindowProcW
GetScrollInfo
EnableWindow
SetWindowLongW
DialogBoxParamW
GetParent
GetWindowLongW
CreateWindowExW
ShowWindow
SendMessageW
RegisterClassA
GetDC
SetScrollRange
DestroyWindow
GetWindowTextW
GetDlgItem
GetClientRect
SetScrollPos
MessageBoxW
GetWindowRect
DrawTextW
MoveWindow
CreateWindowExA
LoadStringW

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 292KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e27ea0ccc718f2737200411d34aa942d

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

ole32

ntdll

gdi32

msvcrt

shlwapi

samlib

user32

Sections

.text Size: 4KB - Virtual size: 4KB

.data Size: 292KB - Virtual size: 1.4MB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 24KB - Virtual size: 24KB

.rdata Size: 3KB - Virtual size: 3KB

.text
Size: 4KB - Virtual size: 4KB

.data
Size: 292KB - Virtual size: 1.4MB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 24KB - Virtual size: 24KB

.rdata
Size: 3KB - Virtual size: 3KB