d1354c114259a069aa40a150b76efee2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d1354c114259a069aa40a150b76efee2_JaffaCakes118
Size

90KB
MD5

d1354c114259a069aa40a150b76efee2
SHA1

1f0cb136de18731dfda5315a0d38c48b21a73fa7
SHA256

14df53562b03bc4cc8ac4d3f1c1e169784327583b0437fe4ac8e0d781c3c47b1
SHA512

5b53fb6df4adbea64389dc06fb213ae8a4686c4005701ba9ff712aeca4539818675dadee7b3e8229ca7869852b5cbb0329ca79d24f117d57cf660acd35296818
SSDEEP

1536:8a6nRtUuJTtlrcK09fvqEIJyskJZzhCExJzIY0kylMEiOC6:8aCRtUEvrn09fyEIo3lCsFhOjis

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ydwzro.exe

Files

d1354c114259a069aa40a150b76efee2_JaffaCakes118
.rar
ydwzro.exe
.exe windows:5 windows x86 arch:x86

0442d54551d80557d1952aa4105890db

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

RestoreDC
CreateFontIndirectA
DeleteDC
CreatePalette
GetClipBox
SelectPalette
GetPixel
CreatePen
GetStockObject
DeleteObject
RectVisible
SetTextAlign
LineTo
PatBlt
SaveDC
CreateCompatibleDC
CreateSolidBrush
GetTextMetricsA
SetStretchBltMode
SelectObject
SetMapMode
GetDeviceCaps
SetTextColor

kernel32

lstrlenW
DeleteFileW
GetTickCount
MulDiv
GetVersion
GetCurrentThreadId
GetModuleHandleA
RemoveDirectoryA
GetACP
GetCommandLineA
GetCurrentProcess
GetStartupInfoA
GetCurrentThread
GetCurrentProcessId
GetOEMCP
GetWindowsDirectoryA
GetConsoleOutputCP
GetUserDefaultLangID
QueryPerformanceCounter
lstrlenA
GlobalFindAtomA
lstrcmpA
SetCurrentDirectoryA
lstrcmpiA
GetProcessHeap
GetCommandLineW
GlobalFindAtomW
lstrcmpiW
IsDebuggerPresent
GetDriveTypeA
CopyFileA
GetModuleHandleW
GetThreadLocale
VirtualAlloc
VirtualFree

user32

GetSystemMetrics
GetParent
TranslateMessage
GetDesktopWindow
GetDC
CharNextA

glu32

gluNurbsCallback

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Lyfptmxi
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Nfkwep D
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0442d54551d80557d1952aa4105890db

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

kernel32

user32

glu32

Sections

.text Size: 11KB - Virtual size: 11KB

Lyfptmxi Size: 512B - Virtual size: 4KB

.rdata Size: 25KB - Virtual size: 25KB

Nfkwep D Size: 512B - Virtual size: 4KB

.data Size: 100KB - Virtual size: 99KB

.rsrc Size: 29KB - Virtual size: 29KB

.text
Size: 11KB - Virtual size: 11KB

Lyfptmxi
Size: 512B - Virtual size: 4KB

.rdata
Size: 25KB - Virtual size: 25KB

Nfkwep D
Size: 512B - Virtual size: 4KB

.data
Size: 100KB - Virtual size: 99KB

.rsrc
Size: 29KB - Virtual size: 29KB