0042834d6532b4f8aa8b02f734f2c062_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0042834d6532b4f8aa8b02f734f2c062_JaffaCakes118
Size

317KB
MD5

0042834d6532b4f8aa8b02f734f2c062
SHA1

a1467beb3ca219b40ef6e3f989e1dc379e604845
SHA256

0d1638ff9c52bb047575b9abc214ea9ac7baf439a2f3dc6eb6b33df528bfcc09
SHA512

03ec280d1cd719565961f033dc3447d462151ba6c8d1a025ccfabbaf16c51bf8c60befa7b2c9dba51f9fda0e64c79cbb10c6441a9334ead482719182ef9be5c7
SSDEEP

6144:zAI+uRqgeLTVHnVL+Psj9xo3FjwnyyrckpjR9+BnB2ANyK:zAuzeLRHVRj3AJg/QKjUnD1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0042834d6532b4f8aa8b02f734f2c062_JaffaCakes118

Files

0042834d6532b4f8aa8b02f734f2c062_JaffaCakes118
.exe windows:5 windows x86 arch:x86

06425aafcdb55b870d11402337e49c6e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalFree
lstrcpyA
CompareStringW
ReadFile
CreateFileW
FlushFileBuffers
WriteConsoleW
SetStdHandle
HeapReAlloc
IsProcessorFeaturePresent
HeapSize
RtlUnwind
CloseHandle
GetConsoleCP
SetFilePointer
Sleep
GetStringTypeW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
DeleteCriticalSection
GetFileType
InitializeCriticalSectionAndSpinCount
GetLastError
lstrlenW
ExitThread
HeapCreate
GetTickCount
LoadLibraryW
GetCurrentProcess
HeapAlloc
GetConsoleMode
GetCommandLineW
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
RaiseException
MultiByteToWideChar
LCMapStringW
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameW
GetStdHandle
WriteFile
ExitProcess
GetTimeZoneInformation
WideCharToMultiByte
GetProcAddress
SetEnvironmentVariableA
GetCurrentThreadId
SetLastError
GetModuleHandleW
TlsFree
HeapFree
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
DecodePointer

user32

IsWindowVisible
UpdateWindow
EnableWindow
GetSystemMetrics
IsWindow
GetSysColorBrush
LoadStringW
GetSysColor
CreateWindowExW
MessageBoxW
GetParent
LoadMenuA
LoadIconA
GetClientRect
GetDC
GetWindowLongA
ReleaseDC
GetDlgItem
CharUpperW

gdi32

GetTextExtentPoint32W
GetTextMetricsW
CreateFontIndirectW
SelectObject
GetStockObject
GetLayout

shell32

ord100
CommandLineToArgvW

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance

oleaut32

SysFreeString
SysAllocString
VariantClear
VariantInit

ws2_32

WSACleanup
WSAStartup

winmm

midiOutSetVolume
midiOutClose
midiOutOpen
midiOutGetDevCapsA

shlwapi

SHRegGetBoolUSValueW

Sections

.text
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 187KB - Virtual size: 237KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

06425aafcdb55b870d11402337e49c6e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

ws2_32

winmm

shlwapi

Sections

.text Size: 95KB - Virtual size: 95KB

.rdata Size: 16KB - Virtual size: 16KB

.data Size: 187KB - Virtual size: 237KB

.rsrc Size: 16KB - Virtual size: 16KB

.text
Size: 95KB - Virtual size: 95KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 187KB - Virtual size: 237KB

.rsrc
Size: 16KB - Virtual size: 16KB