09407b5b5d7864e350e83f1dbdc74523_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

09407b5b5d7864e350e83f1dbdc74523_JaffaCakes118
Size

175KB
MD5

09407b5b5d7864e350e83f1dbdc74523
SHA1

b433ec790cbee21f928a1b22ecac2bbd92a79aa9
SHA256

e013cd1ffd812f33cc39aa18a943b7204a1bb6ff7a9085328725c31388acd5d1
SHA512

94ca9fab56c1105988434866891221d000b63d481383e661705bf408173bb20a555b7b304c67349b94f56c9ccd035644bc22ac3c01e3cc81f62a5232e4883c23
SSDEEP

3072:EcVUaHYq//wkbTxE5xsdJUfn/K6Y3eIgvTRlMIKnWWhOzSeyZmxphDfH9LnMedHK:EcxYq//nXxS+J0Q3e1Cci6hDP9nz9J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09407b5b5d7864e350e83f1dbdc74523_JaffaCakes118

Files

09407b5b5d7864e350e83f1dbdc74523_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f5aee6522e196ab0f2d6b7463106c398

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegOpenKeyA

kernel32

EnterCriticalSection
GlobalFindAtomA
VirtualQuery
GetEnvironmentStrings
CreateFileA
GetFullPathNameA
GetLocaleInfoA
EnumCalendarInfoA
LocalAlloc
VirtualAllocEx
GetCommandLineW
GetLocalTime
VirtualFree
GetACP
lstrlenA
GetProcAddress
MulDiv
LocalFree
GetFileAttributesA
FindFirstFileA
GetDiskFreeSpaceA
SetLastError
CreateThread
CreateEventA
GetModuleHandleA
GetOEMCP
LoadResource
GetModuleHandleW
SetErrorMode
GetLastError
SetHandleCount
ReadFile
MoveFileExA
ExitProcess
VirtualAlloc
MoveFileA
HeapFree
GetStdHandle
LoadLibraryA
ExitThread
SetFilePointer
CloseHandle
DeleteCriticalSection
SetEvent
GetUserDefaultLCID
IsBadHugeReadPtr
lstrlenW
SetThreadLocale
FormatMessageA
DeleteFileA
GetCurrentProcessId
GlobalAlloc
lstrcmpA
ResetEvent
LoadLibraryExA
WideCharToMultiByte
lstrcatA
CompareStringA
SizeofResource
HeapAlloc
InitializeCriticalSection

user32

PostMessageA
LoadCursorA
LoadBitmapA
SendMessageA
LoadIconA
SetActiveWindow
LoadStringA
RemovePropA
PeekMessageA
RegisterWindowMessageA
SendMessageW
OemToCharA
OpenClipboard
RemoveMenu
PtInRect
MapVirtualKeyA
RegisterClassA
LoadKeyboardLayoutA
RedrawWindow
PeekMessageW
RegisterClipboardFormatA
ReleaseCapture
PostQuitMessage
OffsetRect
MessageBeep
MessageBoxA
ReleaseDC
ScreenToClient
MapWindowPoints
ScrollWindow

shell32

SHGetDesktopFolder

ole32

CreateStreamOnHGlobal
PropVariantClear
CoGetObjectContext
ReleaseStgMedium
CoReleaseMarshalData

comctl32

ImageList_Destroy
ImageList_DragShowNolock
ImageList_DrawEx
ImageList_Add

Sections

CODE
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: 2KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

DATA
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cdata
Size: 1024B - Virtual size: 862B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f5aee6522e196ab0f2d6b7463106c398

Headers

File Characteristics

Imports

advapi32

kernel32

user32

shell32

ole32

comctl32

Sections

CODE Size: 42KB - Virtual size: 42KB

.rdata Size: 111KB - Virtual size: 111KB

.data Size: 8KB - Virtual size: 7KB

.adata Size: 2KB - Virtual size: 85KB

DATA Size: 8KB - Virtual size: 7KB

.cdata Size: 1024B - Virtual size: 862B

.rsrc Size: 1024B - Virtual size: 864B

CODE
Size: 42KB - Virtual size: 42KB

.rdata
Size: 111KB - Virtual size: 111KB

.data
Size: 8KB - Virtual size: 7KB

.adata
Size: 2KB - Virtual size: 85KB

DATA
Size: 8KB - Virtual size: 7KB

.cdata
Size: 1024B - Virtual size: 862B

.rsrc
Size: 1024B - Virtual size: 864B