f5b752c0f53376ce2ad8cb490e31d56f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f5b752c0f53376ce2ad8cb490e31d56f_JaffaCakes118
Size

124KB
MD5

f5b752c0f53376ce2ad8cb490e31d56f
SHA1

33a53745da7d55c52f2de729ee96f32f0627ddf2
SHA256

9d5352e263e8743b942c61eb7048eef1ec363f64c27510ec04cc8df15bc2df3f
SHA512

d0ab566320d8f83e9ca952e01c20b7cfcf8c69172210ab4ea309c1d79af17ce8492a27ac7a87fa5a9784a480aaa2f8d4c554f1d06e2aab24053071809f2b0123
SSDEEP

1536:Q5e0O0vTHiV0sZppZFjbu+QF0YEF+7oTMrTs5995S+UZZS/zA5n6gOyBO5L9FZ9K:KeD0CpZ/c7oY+TSJZZS7mzK3jGiC/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f5b752c0f53376ce2ad8cb490e31d56f_JaffaCakes118

Files

f5b752c0f53376ce2ad8cb490e31d56f_JaffaCakes118
.exe windows:5 windows x86 arch:x86

974ae317f1f350c8a4442c6dcb6d4ed3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

M:\KqewjlP\Zutzx\thxk\hrkhxt.pdb

Imports

user32

DialogBoxIndirectParamA
IsWindowVisible
GetDCEx
SendDlgItemMessageW
CheckRadioButton
GetMessageExtraInfo
IsCharAlphaA
CharUpperA
LoadAcceleratorsA
ShowWindow
MapVirtualKeyExW
InsertMenuItemW
GetKeyNameTextW
CreateCursor

comctl32

ImageList_LoadImageW
ImageList_GetIconSize
PropertySheetW
CreateStatusWindowW

gdi32

RemoveFontResourceW
EndPath
GetMapMode
GetStockObject
SetTextColor
CreateFontW

shlwapi

PathMakePrettyW
StrDupW

ntdll

memset
_stricmp

kernel32

lstrcmpiW
FindFirstFileW
CreateMailslotW
InterlockedExchangeAdd
FlushFileBuffers
CreateMutexA
ExitProcess
InterlockedExchange
WaitForMultipleObjectsEx
WaitForSingleObjectEx
GetCurrentProcessId

Exports

Exports

?h_mffdxhKKT_oku@@YGPAMPAKJ@Z
?pnjg_w_VLzUXRPT@@YGKPAID@Z
?_s__zlu_BZEL_LD@@YGGF@Z
?__MCX_ELff_s@@YGPADPAF@Z
?i___wwk@@YGPANG@Z
?G_O_O_gvqqulCF@@YGKI@Z
?mFB_BXIXH_@@YGXPAE@Z
?ibFOYspasnuuRQOkJHO@@YGHPAFF@Z
?c_qy_jqJ_IX@@YGGJ@Z
?utp__vw_@@YGEIJ@Z
?s__mc_A____xveb@@YGIPAJ@Z
?xlxAFemrxvxon_p_vD_O@@YGEJPAH@Z
?J_IyyppgtQ_ixivuTwgq@@YGPAJPAHPAF@Z
?_QPKJj_hsvpx_hjt@@YGHPAJ@Z
?_RTASP_A_Abg@@YGXPAK@Z
?ETBUHK_CEL_NZnbjg_@@YGXKG@Z
?RKIFotgsdb@@YGGIG@Z
?_O_GM_P__UCTDGGJ@@YGKK@Z

Sections

.code
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 394KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.import
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 1024B - Virtual size: 908B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

974ae317f1f350c8a4442c6dcb6d4ed3

Headers

File Characteristics

PDB Paths

Imports

user32

comctl32

gdi32

shlwapi

ntdll

kernel32

Exports

Exports

Sections

.code Size: 25KB - Virtual size: 24KB

.data Size: 62KB - Virtual size: 394KB

.rdata Size: 28KB - Virtual size: 27KB

.import Size: 1KB - Virtual size: 1KB

.edata Size: 1024B - Virtual size: 908B

.rsrc Size: 3KB - Virtual size: 4KB

.reloc Size: 2KB - Virtual size: 1KB

.code
Size: 25KB - Virtual size: 24KB

.data
Size: 62KB - Virtual size: 394KB

.rdata
Size: 28KB - Virtual size: 27KB

.import
Size: 1KB - Virtual size: 1KB

.edata
Size: 1024B - Virtual size: 908B

.rsrc
Size: 3KB - Virtual size: 4KB

.reloc
Size: 2KB - Virtual size: 1KB