c0f38c2b58397a0f0bb7d4a44f9aaa26_JaffaCakes118

General

Target

c0f38c2b58397a0f0bb7d4a44f9aaa26_JaffaCakes118
Size

244KB
MD5

c0f38c2b58397a0f0bb7d4a44f9aaa26
SHA1

53bcddc65b966b7c489903e04cbe2b4d96927411
SHA256

7aed09d1ceeeab134f3a85d6ccbf634a4a79b942c0e19a39fb92b0a9ee717fb8
SHA512

0ba384815be8cd041abbf7e73d45723a4711eaeaa428d81ff042223b7f02b0d6c71e3fb7a9b690ecce1a6d4fda5fda15785191ab1763466c4c0aab30969d51ef
SSDEEP

6144:zmuQ2NM6xtt1zuaHSSBFtuJp+tg67Fxb/JASdEMFQZ:NFtDKaySBOpEF1HS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0f38c2b58397a0f0bb7d4a44f9aaa26_JaffaCakes118

Files

c0f38c2b58397a0f0bb7d4a44f9aaa26_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a82202dc1ef40ef383a80af6436fed01

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetClipboardData
CloseDesktop
GetDlgItem
ToUnicode
GetDlgItemTextA
OpenWindowStationA
PeekMessageA
GetKeyboardState
GetIconInfo
LoadCursorA
GetWindowLongA
GetKeyState
SetProcessWindowStation
OpenDesktopA
DrawIcon
EndDialog

shlwapi

wnsprintfA
SHDeleteKeyA
StrStrW
PathCombineW
wvnsprintfW
StrCmpNIW
PathRemoveFileSpecW
PathMatchSpecW
PathFindFileNameW

kernel32

CreateThread
GetFileSizeEx
VirtualAlloc
CreateProcessW
CopyFileW
GetModuleHandleA
lstrcpyA
lstrlenA
GetProcAddress
VirtualProtect
SetEvent
GetTickCount
HeapAlloc
EnterCriticalSection
LoadLibraryA
GetFileTime
HeapReAlloc
ExpandEnvironmentStringsW
MultiByteToWideChar
GetCommandLineA
FindResourceW
InitializeCriticalSection
FindFirstFileW
LeaveCriticalSection
GetDiskFreeSpaceW
GetFileAttributesA

advapi32

RegQueryValueExA
RegEnumKeyExA
RegCreateKeyExA
CryptAcquireContextW
CryptGetHashParam
CryptHashData
RegCloseKey
RegSetValueExA
RegDeleteValueA
CryptCreateHash
DuplicateTokenEx
GetUserNameW
CryptDestroyHash

Sections

.text
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a82202dc1ef40ef383a80af6436fed01

Headers

DLL Characteristics

File Characteristics

Imports

user32

shlwapi

kernel32

advapi32

Sections

.text Size: 62KB - Virtual size: 62KB

.rdata Size: 512B - Virtual size: 196B

.data Size: 512B - Virtual size: 16KB

.text
Size: 62KB - Virtual size: 62KB

.rdata
Size: 512B - Virtual size: 196B

.data
Size: 512B - Virtual size: 16KB