b5170fccd6ddc5e0f4348b244e491c15_JaffaCakes118

General

Target

b5170fccd6ddc5e0f4348b244e491c15_JaffaCakes118
Size

771KB
MD5

b5170fccd6ddc5e0f4348b244e491c15
SHA1

19b6163529333659e89dc99de54ca41e53ab27ac
SHA256

1b84dbb74bfbb18eb3d280634dd10bffe9f64861a35454b04a465144ac264116
SHA512

1cdcdba514af9ff4a5a215466a58bb481a31ba41cefcd4d9676104ef5d0b046cbc17d17318f2ea0b12237036a95f3c89c7d8300475039403a21f94ce9490669a
SSDEEP

24576:jLysb8U77JlOtkKLj+uQycU6zZtmItVJBQS:j5YU73Oxyr9iItzGS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b5170fccd6ddc5e0f4348b244e491c15_JaffaCakes118

Files

b5170fccd6ddc5e0f4348b244e491c15_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4cf23e860d6fb8dfb969cd18df2c563a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey

user32

GetParent
PostMessageW
DestroyWindow
GetMenuState
CreateDialogIndirectParamW
OpenClipboard
PostQuitMessage
GetMessageW
DrawIconEx
AdjustWindowRectEx
GetClipboardFormatNameW
CallNextHookEx
RemoveMenu

kernel32

GetStringTypeA
LCMapStringW
MultiByteToWideChar
LoadLibraryA
LCMapStringA
InterlockedIncrement
GetStringTypeW
InterlockedDecrement
InitializeCriticalSection
WriteFile
HeapFree
VirtualFree
RtlUnwind
GetEnvironmentVariableA
GetModuleHandleA
HeapDestroy
GetVersionExA
HeapCreate
GetACP
GetCPInfo
EnterCriticalSection
HeapAlloc
HeapReAlloc
GetOEMCP
VirtualAlloc
GetProcAddress
GetLastError
TlsGetValue
TlsAlloc
SetLastError
GetFileType
GetStartupInfoA
GetCurrentThreadId
TlsSetValue
FreeEnvironmentStringsW
GetModuleFileNameA
FreeEnvironmentStringsA
GetCurrentProcess
TerminateProcess
UnhandledExceptionFilter
GetEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
SetHandleCount
GetStdHandle
ExitProcess
GetVersion
LeaveCriticalSection
CreateFileMappingW
GetCommandLineA

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 1023KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4cf23e860d6fb8dfb969cd18df2c563a

Headers

File Characteristics

Imports

advapi32

user32

kernel32

Sections

.text Size: 32KB - Virtual size: 31KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 12KB - Virtual size: 1023KB

.tls Size: 4KB - Virtual size: 12B

.rsrc Size: 100KB - Virtual size: 99KB

.text
Size: 32KB - Virtual size: 31KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 1023KB

.tls
Size: 4KB - Virtual size: 12B

.rsrc
Size: 100KB - Virtual size: 99KB