0123dee8359ce01313ab1d6171f6cc88_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0123dee8359ce01313ab1d6171f6cc88_JaffaCakes118
Size

98KB
MD5

0123dee8359ce01313ab1d6171f6cc88
SHA1

3a70ab0c315030faff504cd9283dba8d6f6a3403
SHA256

b275afc7e385b49d2146a73cf015337ad8c1654d7422f22ddfc0ef74138eaae2
SHA512

71bfc7c305706808e3a5dc9f84f69d3397f1a221dbd16d5b06fa970e223088176f011726d7eb89bcbc8c08e6d1b505a790a61854a0abeda21972ed1c2d8e0632
SSDEEP

3072:aiIvKnTwvP3NvSsvNnQtdBdeClmtpEkWtjM:x6KnTwn3Nas1n8dBRFR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0123dee8359ce01313ab1d6171f6cc88_JaffaCakes118

Files

0123dee8359ce01313ab1d6171f6cc88_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a14353a642a20ebc1201cc1881335b66

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

malloc
_adjust_fdiv
__p__environ
atoi
_vsnprintf
fflush
_initterm
__setusermatherr
_acmdln
_exit
atexit
strrchr
strstr
fclose
calloc
_except_handler3
fwrite
strlen
__set_app_type
__getmainargs
__p__fmode
free
__p__commode
strchr
strncpy

kernel32

GetStartupInfoA
LoadLibraryExW
WaitForSingleObject
GetCurrentProcess
GetShortPathNameA
GetProcAddress
GetCurrentDirectoryA
GetUserDefaultLangID
WriteFile
ReadFile
GetCPInfo
VirtualProtect
MulDiv
FreeLibrary
UnhandledExceptionFilter
GetSystemDirectoryA

comctl32

InitCommonControlsEx
ImageList_DragEnter
ImageList_SetImageCount
ImageList_DragLeave
ImageList_Write
ImageList_GetIconSize
ImageList_ReplaceIcon
ImageList_Draw
ImageList_LoadImageA
ImageList_GetIcon
ImageList_Add

gdi32

GetMetaFileBitsEx
DeleteDC
DeleteObject
CreatePatternBrush
GetEnhMetaFilePaletteEntries
LineTo
GetDIBits
GetRegionData
SetGraphicsMode
RestoreDC
SetBkColor
CombineRgn
SetWorldTransform

user32

PostMessageA
EnumThreadWindows
BeginPaint
SetClipboardData
SetWindowPos
GetSystemMetrics
OffsetRect
LoadBitmapA
ReleaseDC
GetMessagePos
CreateMenu
ScreenToClient
GetTopWindow
CreateWindowExA
RemoveMenu

advapi32

DeregisterEventSource
EqualSid
CheckTokenMembership
GetUserNameA
CryptReleaseContext
RevertToSelf
OpenThreadToken
SetSecurityDescriptorOwner
CryptAcquireContextA
RegEnumValueW
RegEnumKeyExW
AddAccessAllowedAce
RegQueryInfoKeyW
RegCreateKeyA
CryptCreateHash

oleaut32

SafeArrayPutElement
VariantClear
SysStringLen
GetErrorInfo
SafeArrayGetUBound
VariantCopy
VariantCopyInd

ole32

DoDragDrop
OleGetClipboard
CreateBindCtx
StringFromCLSID
CoFreeUnusedLibraries
StgOpenStorageOnILockBytes

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a14353a642a20ebc1201cc1881335b66

Headers

File Characteristics

Imports

msvcrt

kernel32

comctl32

gdi32

user32

advapi32

oleaut32

ole32

Sections

.text Size: 56KB - Virtual size: 55KB

.data Size: 25KB - Virtual size: 24KB

.rsrc Size: 16KB - Virtual size: 15KB

.text
Size: 56KB - Virtual size: 55KB

.data
Size: 25KB - Virtual size: 24KB

.rsrc
Size: 16KB - Virtual size: 15KB