0346cc68d672c6934c762929a3807a49_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0346cc68d672c6934c762929a3807a49_JaffaCakes118
Size

183KB
MD5

0346cc68d672c6934c762929a3807a49
SHA1

db06b71200cb740718da9e18839d7785659581d8
SHA256

ed3120db0cac3bbdc0b861494bae33ca8c9ca694996a8e53edb7f8306c8edaa4
SHA512

a5c6799c8e4ceb27391f1df068ad0e41adc040de4e735ce23a4adc1e7c16f0a49a9f3e8c31b4a06a192f85b7aba194b811ac64d65594c1c2148d23df9f891a68
SSDEEP

3072:BdLqtTmEo4oHs6MgfYb2kHdhR558bO3iC41hqENfam0pwb1dZ7782aSRvxGy9wie:Bd8lO/4N4uRpi1dZ77WaJGcwiw0t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0346cc68d672c6934c762929a3807a49_JaffaCakes118

Files

0346cc68d672c6934c762929a3807a49_JaffaCakes118
.exe windows:5 windows x86 arch:x86

9b4897c501e88a1eb2311ab4fffad343

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrCSpnW
StrStrIA
PathGetDriveNumberW
PathStripPathA
PathFindExtensionW
PathSkipRootW
PathStripPathW
StrStrA
StrCmpW
PathRemoveBlanksW
PathStripToRootW
PathRemoveExtensionA
PathFindFileNameW
StrTrimA
StrCSpnA
StrStrW
PathRemoveExtensionW
PathFindFileNameA
PathSkipRootA
PathFindExtensionA
StrTrimW
PathRemoveBlanksA
StrStrIW
StrCmpIW
PathStripToRootA
PathGetDriveNumberA

user32

GetClientRect
FindWindowW
GetDesktopWindow
GetForegroundWindow
FindWindowA

mfc42

?classCCachedDataPathProperty@CCachedDataPathProperty@@2UCRuntimeClass@@B
DllUnregisterServer
DllRegisterServer
DllCanUnloadNow
?classCDataPathProperty@CDataPathProperty@@2UCRuntimeClass@@B

sqlwoa

_TranslateAccelerator@12
_GetWindowTextLength@4
_StartDoc@8
_CommDlg_OpenSave_GetFolderPath@12
_GetTextMetrics@8

hid

HidD_GetProductString
HidP_GetLinkCollectionNodes
HidP_GetData
HidP_GetExtendedAttributes
HidD_GetPhysicalDescriptor

msoeacct

HrCreateAccountManager
GetDllMajorVersion
ValidEmailAddress
DllGetClassObject
DllCanUnloadNow

inseng

DllGetClassObject
GetICifRWFileFromFile
GetICifFileFromFile
DownloadFile
CheckTrust

powrprof

SetActivePwrScheme
WritePwrScheme
LoadCurrentPwrScheme
IsPwrSuspendAllowed
ReadGlobalPwrPolicy

kernel32

TerminateProcess
SetConsoleCursorPosition
VirtualAlloc
lstrlenA
Thread32Next

tapi32

lineGetAgentCapsW
lineDevSpecificFeature
phoneGetStatusW
lineCreateAgentW
phoneGetHookSwitch

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 151KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9b4897c501e88a1eb2311ab4fffad343

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

user32

mfc42

sqlwoa

hid

msoeacct

inseng

powrprof

kernel32

tapi32

Sections

.text Size: 26KB - Virtual size: 25KB

.data Size: 151KB - Virtual size: 154KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 26KB - Virtual size: 25KB

.data
Size: 151KB - Virtual size: 154KB

.reloc
Size: 5KB - Virtual size: 4KB