e04994c06aa0bf443dc81f2450715c95_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e04994c06aa0bf443dc81f2450715c95_JaffaCakes118
Size

80KB
MD5

e04994c06aa0bf443dc81f2450715c95
SHA1

ea55eba2081116a7384056b8511310d7f5aa695c
SHA256

41a7f99b6773c026a3fc033ba714c3ddf655229f89483a06f81945cbc4d2cd45
SHA512

dc1fb670004f754a09568b502912a45253e29fc082b806d6258eca7b4772f78d9ec672b33d60e00aa7c60a34740c272dbdcad7bbd204b80094c4f3caa84fb3bd
SSDEEP

1536:LPPEyu6yr1OY+4RI2WGBoxj54UrMW1jFLuMSADz72mMyWsSsM:LPP7u7x5WqU+UgW/yuDvPxWs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e04994c06aa0bf443dc81f2450715c95_JaffaCakes118

Files

e04994c06aa0bf443dc81f2450715c95_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ec56ff4a0ae274c36bc94f9bccf139b8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

user32

PostQuitMessage
SetWindowPos
UnhookWindowsHookEx
SetWindowTextA
EnumWindows
FrameRect
EqualRect
GetMessageA
GetSysColorBrush
GetSubMenu
EnableMenuItem
GetScrollPos
GetSysColor

kernel32

ExitProcess
GetTickCount
GetThreadLocale
GetCurrentProcessId
InterlockedExchange
FileTimeToSystemTime
GetTimeZoneInformation
GetTempPathA
VirtualAllocEx
RtlUnwind
GetSystemTime
SetUnhandledExceptionFilter
GetStartupInfoA
GetFileAttributesA
GetOEMCP

gdi32

CopyEnhMetaFileA
FillRgn
GetMapMode
DPtoLP
SetViewportExtEx
ExcludeClipRect
SelectClipPath
CreateICW
CreateCompatibleBitmap

ole32

DoDragDrop
CoTaskMemRealloc
StgOpenStorage
CoRevokeClassObject
OleRun
StringFromGUID2
CoInitializeSecurity
CoInitialize
CoCreateInstance

advapi32

GetUserNameA
RegQueryValueExW
GetSecurityDescriptorDacl
RegCreateKeyA
CryptHashData
CheckTokenMembership
FreeSid
AdjustTokenPrivileges
QueryServiceStatus
RegCreateKeyExW

msvcrt

_mbscmp
strncpy
__setusermatherr
_fdopen
strlen
strcspn
raise
iswspace
_flsbuf
__initenv
__getmainargs
fflush
_CIpow
signal
puts
fprintf
_strdup
_lock

comctl32

ImageList_Write
ImageList_Destroy
CreatePropertySheetPageA
ImageList_LoadImageA
ImageList_DragEnter
ImageList_SetIconSize
ImageList_GetIcon
ImageList_GetBkColor
ImageList_DrawEx
ImageList_LoadImageW
InitCommonControls
ImageList_GetIconSize
ImageList_ReplaceIcon

shell32

ShellExecuteEx
CommandLineToArgvW
SHGetPathFromIDList
SHBrowseForFolderA
DragQueryFileA
ExtractIconExW
ExtractIconW
DragAcceptFiles
ShellExecuteW
DoEnvironmentSubstW
DragQueryFileW

oleaut32

VariantCopy
SafeArrayGetUBound
SysReAllocStringLen
SafeArrayPtrOfIndex
SafeArrayCreate
SafeArrayPutElement
SafeArrayRedim
SafeArrayUnaccessData

Sections

.text
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ec56ff4a0ae274c36bc94f9bccf139b8

Headers

File Characteristics

Imports

user32

kernel32

gdi32

ole32

advapi32

msvcrt

comctl32

shell32

oleaut32

Sections

.text Size: 33KB - Virtual size: 32KB

.data Size: 40KB - Virtual size: 40KB

.rsrc Size: 6KB - Virtual size: 76KB

.text
Size: 33KB - Virtual size: 32KB

.data
Size: 40KB - Virtual size: 40KB

.rsrc
Size: 6KB - Virtual size: 76KB