0545371238c8ba667d4362afd7b20b5f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0545371238c8ba667d4362afd7b20b5f_JaffaCakes118
Size

185KB
MD5

0545371238c8ba667d4362afd7b20b5f
SHA1

06ba4d252501cb61995f5fcbbbee5147d253f7f7
SHA256

d8c729b8191176827e53aff5e2443a2f79b40231462f63c70536f0fe5f5e7757
SHA512

855a32da8ca6b0071812f130b8b476594b2db03c2297ea1ac5589e939fb5d2cb54a25dda9daf201e8820a176876c0ad45fae3a9aadee5edb32b8bda3d71f3796
SSDEEP

3072:JZ9UoFYyqlt90mHr04eSZnLEzY0OBJz8E9UJuntlNFTM:DPYJbbLDpZh0OBJIkcut7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0545371238c8ba667d4362afd7b20b5f_JaffaCakes118

Files

0545371238c8ba667d4362afd7b20b5f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

35a5e56c53771e638bc13be01bdac502

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryValueExA
RegLoadKeyA

ole32

PropVariantClear
ReleaseStgMedium
StgCreateDocfileOnILockBytes
CLSIDFromString

oleaut32

SafeArrayUnaccessData
SafeArrayCreate
SafeArrayUnaccessData
SafeArrayGetUBound
SafeArrayPtrOfIndex
SysFreeString
SafeArrayCreate
VariantChangeType
SysReAllocStringLen
VariantCopyInd
OleLoadPicture
SysAllocStringLen

msvcrt

asin
tolower
atan
memset
mbstowcs
strlen
memcmp
pow
memcpy
memcmp

version

VerInstallFileA
GetFileVersionInfoA
VerQueryValueA
VerFindFileA

shell32

SHFileOperationA
SHGetDiskFreeSpaceA

kernel32

GetCommandLineA
GetModuleHandleA
LoadLibraryExA
GetLastError
GetProcAddress
IsBadHugeReadPtr
ExitProcess
lstrlenA
Sleep
VirtualAlloc
ExitThread
CloseHandle
VirtualAllocEx

comctl32

ImageList_Write
ImageList_DrawEx
ImageList_DragShowNolock
ImageList_Draw
ImageList_Add
ImageList_Destroy
ImageList_Create
ImageList_GetBkColor
ImageList_Remove
ImageList_Read

gdi32

SaveDC
CreateFontIndirectA
GetClipBox
SelectObject
GetPixel

user32

AdjustWindowRectEx
BeginPaint
CallNextHookEx

shlwapi

SHGetValueA
SHQueryInfoKeyA
PathIsContentTypeA
SHEnumValueA
PathFileExistsA
SHDeleteKeyA
SHStrDupA
PathIsDirectoryA
SHDeleteValueA

comdlg32

ChooseColorA

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fdata
Size: 1024B - Virtual size: 670B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.cdata
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

35a5e56c53771e638bc13be01bdac502

Headers

File Characteristics

Imports

advapi32

ole32

oleaut32

msvcrt

version

shell32

kernel32

comctl32

gdi32

user32

shlwapi

comdlg32

Sections

.text Size: 46KB - Virtual size: 45KB

.rdata Size: 1024B - Virtual size: 88KB

.data Size: 8KB - Virtual size: 7KB

.fdata Size: 1024B - Virtual size: 670B

.cdata Size: 123KB - Virtual size: 122KB

.bdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 1024B - Virtual size: 980B

.text
Size: 46KB - Virtual size: 45KB

.rdata
Size: 1024B - Virtual size: 88KB

.data
Size: 8KB - Virtual size: 7KB

.fdata
Size: 1024B - Virtual size: 670B

.cdata
Size: 123KB - Virtual size: 122KB

.bdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 1024B - Virtual size: 980B