df54bc26587065204e5760fce93fddb9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

df54bc26587065204e5760fce93fddb9_JaffaCakes118
Size

538KB
MD5

df54bc26587065204e5760fce93fddb9
SHA1

b9a4d9bdad69530e4dc8f29c85456c0b1bb50507
SHA256

3ca934c974287933b733a18278e1ad9014a449446b0ed1561e61ef7f263ec12e
SHA512

d721c0cea98a8ec546e40337d283f4f433057f73b70bce7dc7c7f41bef786795d87a834a63e8a318e31339b59c23dd2d98977542af7f1291ca7843c1863c45ab
SSDEEP

12288:sV2xkJu/8ZL4PBGibE4FgQSD8Dxk8RDd3+Nxz2XzfrHksI0fy:scxkJR4PBXsskIduD2XTrEsI0q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df54bc26587065204e5760fce93fddb9_JaffaCakes118

Files

df54bc26587065204e5760fce93fddb9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

43c70f8f097fecda8198bd0d80ca238e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHEmptyRecycleBinW
ShellAboutA
ExtractIconA
SHLoadInProc

comctl32

InitCommonControlsEx

comdlg32

GetSaveFileNameA
ReplaceTextW
PageSetupDlgW

user32

SetWindowsHookExW
EndTask
RegisterClassA
LoadBitmapW
LoadAcceleratorsA
RegisterClassExA
GetDlgItem

gdi32

SetEnhMetaFileBits
EnumFontFamiliesW
EqualRgn
GetBkColor
CreateHalftonePalette
FillPath
ScaleWindowExtEx
GdiSetBatchLimit
FloodFill
GetCharWidthA
RoundRect
EnumMetaFile
GetKerningPairsW

kernel32

QueryPerformanceCounter
MultiByteToWideChar
HeapAlloc
GetVersionExA
GetCurrentThreadId
GetTimeFormatA
GetSystemInfo
SetFilePointer
WriteFile
CompareStringA
HeapFree
lstrcmp
FindAtomW
CreateMutexA
VirtualProtect
GetSystemTimeAsFileTime
GetTickCount
SetHandleCount
GetModuleHandleA
GetStdHandle
IsValidLocale
UnhandledExceptionFilter
GetCurrentThread
GetStringTypeA
GetDateFormatA
ContinueDebugEvent
GlobalGetAtomNameA
TlsFree
FreeEnvironmentStringsW
WideCharToMultiByte
GetLocaleInfoW
EnterCriticalSection
CompareStringW
GetOEMCP
IsValidCodePage
SetEnvironmentVariableA
RtlUnwind
GetEnvironmentStrings
GetACP
GetCommandLineA
GetCurrentProcessId
TlsAlloc
GetStringTypeW
IsBadWritePtr
GetUserDefaultLCID
LCMapStringW
SetStdHandle
VirtualFree
HeapDestroy
LoadLibraryA
CloseHandle
HeapCreate
GetLastError
EnumSystemLocalesA
ReadFile
HeapSize
GetStartupInfoA
LoadModule
TerminateProcess
GetProcAddress
LeaveCriticalSection
SetLastError
TlsGetValue
TlsSetValue
GetCPInfo
InterlockedExchange
FlushFileBuffers
OpenMutexA
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
GetCurrentProcess
WaitForDebugEvent
DebugBreak
ExitProcess
GetFileAttributesExA
GetModuleFileNameA
GetPrivateProfileSectionNamesW
DeleteCriticalSection
VirtualQuery
GetEnvironmentStringsW
FreeEnvironmentStringsA
GetTimeZoneInformation
LCMapStringA
GetFileType
FillConsoleOutputCharacterW
GetLocaleInfoA

advapi32

CryptSetProviderExA
CryptSetProvParam
CryptDuplicateKey
CryptGetHashParam
RevertToSelf

Sections

.text
Size: 210KB - Virtual size: 210KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 314KB - Virtual size: 314KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

43c70f8f097fecda8198bd0d80ca238e

Headers

File Characteristics

Imports

shell32

comctl32

comdlg32

user32

gdi32

kernel32

advapi32

Sections

.text Size: 210KB - Virtual size: 210KB

.rdata Size: 8KB - Virtual size: 23KB

.data Size: 314KB - Virtual size: 314KB

.rsrc Size: 3KB - Virtual size: 3KB

.text
Size: 210KB - Virtual size: 210KB

.rdata
Size: 8KB - Virtual size: 23KB

.data
Size: 314KB - Virtual size: 314KB

.rsrc
Size: 3KB - Virtual size: 3KB