faa2ad93018fc7cab8e4e913301282e8_JaffaCakes118

General

Target

faa2ad93018fc7cab8e4e913301282e8_JaffaCakes118
Size

192KB
MD5

faa2ad93018fc7cab8e4e913301282e8
SHA1

f11c373fc162ee623b90ec7ae53d79a399ddd9a1
SHA256

7b135bbe65c12cf0b4b27c93af209e4c4bbbf4fa0a3ff2c421986b506a29a439
SHA512

3af3b3057dffaea9cc338e83226d9775f6260cf63d447998d32f0e6710f4291f2c4bb8fc8ca337c5dd6daa0c9a42b0e1223cdc0ca13810c7c854269eb47d3721
SSDEEP

3072:HNLjhunAwlI7d64xybyTvPtRlz/ANG3QbnsJNhtcEYjHWoMO5:HxhunJlM66bv3ksRlYjRh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
faa2ad93018fc7cab8e4e913301282e8_JaffaCakes118

Files

faa2ad93018fc7cab8e4e913301282e8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

179ac91f84b8d5fb5eebccce343e9416

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetActiveWindow
wsprintfA
FlashWindow

shlwapi

PathFileExistsA
SHDeleteKeyA
SHCopyKeyA
SHGetValueA

kernel32

GetExitCodeThread
GetModuleFileNameA
GetCurrentThreadId
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
GetStartupInfoA
GetCommandLineA
ExitProcess
GetTickCount
IsBadWritePtr
GetCurrentProcess
CloseHandle
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
GetLastError
CreateDirectoryA
DeleteFileA
SetFileAttributesA
GetFileAttributesA
GetSystemDirectoryA
GetModuleHandleA
GetProcAddress
Sleep
LoadLibraryA
GetCurrentDirectoryA
GetTempPathA
WriteFile
SetFilePointer
CreateFileA
WaitForSingleObject
CreateEventA
ExpandEnvironmentStringsA
SetEnvironmentVariableA
SleepEx
IsBadReadPtr
ExitThread
SetUnhandledExceptionFilter
CreateThread

msvcrt

_strupr
_itoa
memmove
__CxxFrameHandler
rand
_ftol
malloc
tolower
strncmp
_except_handler3
memset
srand
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
_controlfp

ws2_32

closesocket
getprotobynumber

Sections

CODE
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 164KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

179ac91f84b8d5fb5eebccce343e9416

Headers

File Characteristics

Imports

user32

shlwapi

kernel32

msvcrt

ws2_32

Sections

CODE Size: 20KB - Virtual size: 18KB

.data Size: 164KB - Virtual size: 166KB

.rsrc Size: 4KB - Virtual size: 1KB

CODE
Size: 20KB - Virtual size: 18KB

.data
Size: 164KB - Virtual size: 166KB

.rsrc
Size: 4KB - Virtual size: 1KB