028cd74a342766dcf68ed6823e3c30f5_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

028cd74a342766dcf68ed6823e3c30f5_JaffaCakes118
Size

271KB
MD5

028cd74a342766dcf68ed6823e3c30f5
SHA1

2a70285808c67ba1e9e9d41d6dd7847539ae3587
SHA256

e90f941eaba690928c4cfac097bb4673cfc5eab1b4aa79a9267482fc355f2427
SHA512

5de766ffd614d22c3a6f91659c0a6bd158763074cad3fc71d76af7b09635b41183dd7a958282335c728f3fdd167e29185bbb05ebca2145b3c7addc54aea20835
SSDEEP

6144:UG5xiaf5qbpFVqKKP8yL0LMi2W/1GIKM8yOjveAv4:UG5xJacP33M1y9jGAv4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
028cd74a342766dcf68ed6823e3c30f5_JaffaCakes118

Files

028cd74a342766dcf68ed6823e3c30f5_JaffaCakes118
.exe windows:5 windows x86 arch:x86

d5866256aab1e2220e2e02f4ff0c9d0d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcatA
GetProcAddress
LoadLibraryA
LockResource
WriteProfileStringA
CreateIoCompletionPort
HeapReAlloc
GetBinaryTypeA
MultiByteToWideChar
LCMapStringW
HeapSize
RtlUnwind
Sleep
HeapFree
IsValidCodePage
GetOEMCP
HeapCreate
SetCommTimeouts
GetCurrentProcess
LoadResource
FreeResource
FindResourceA
GetStringTypeW
FileTimeToDosDateTime
GetACP
GetCPInfo
GetLocaleInfoW
LoadLibraryW
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
EnterCriticalSection
FatalAppExitA
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
HeapAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
HeapDestroy
EncodePointer
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
GetCurrentThread
QueryPerformanceCounter
IsProcessorFeaturePresent

user32

LoadStringA
SetWindowTextA
AppendMenuA
OffsetRect
GetDC
PtInRect
CopyImage
SetProcessWindowStation
SetMessageQueue

gdi32

GetWindowExtEx
MaskBlt
GetEnhMetaFileDescriptionA
SetTextCharacterExtra
PaintRgn
GetTextCharset
DeleteEnhMetaFile

shell32

SHLoadNonloadedIconOverlayIdentifiers
SHBrowseForFolderA
SHGetInstanceExplorer
SHGetDiskFreeSpaceExA

winmm

auxGetDevCapsA
mixerClose
joyGetNumDevs
mciGetErrorStringA
mmioRead
mmioRenameA
midiStreamRestart

Sections

.text
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 216KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d5866256aab1e2220e2e02f4ff0c9d0d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

winmm

Sections

.text Size: 38KB - Virtual size: 38KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 3KB - Virtual size: 9KB

.rsrc Size: 216KB - Virtual size: 216KB

.text
Size: 38KB - Virtual size: 38KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 3KB - Virtual size: 9KB

.rsrc
Size: 216KB - Virtual size: 216KB