13f3fccbbc76bb5dea5ebe1f33976f10_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

13f3fccbbc76bb5dea5ebe1f33976f10_JaffaCakes118
Size

628KB
MD5

13f3fccbbc76bb5dea5ebe1f33976f10
SHA1

49582d92d7f29f5ac961b85880d627a1d4d915f3
SHA256

df53cee38efbcac822857a86c03efb8ab9eff64e1320f23d0de3e5aa7a511c76
SHA512

f0f46e9fe80bc4f758a3adbb120ffbd334958bbda03ce1267238c01d713149b1ee10720f32a753284e70fc127c6e01e8989efa9687df904c4167dd25336b6eb7
SSDEEP

12288:1B9Qb6lSDkq7++aYE+AHGDABW3iulbykNVxWIbOstuBZfFRIeonaDJ4igR3H1:1B9QWlSDkDdGDHSSrNLHudRIFnaDyis

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
13f3fccbbc76bb5dea5ebe1f33976f10_JaffaCakes118

Files

13f3fccbbc76bb5dea5ebe1f33976f10_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4bd80aef9c4a294187de4511b5e55c21

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

UnregisterClassW
RemovePropA
DispatchMessageW
ChangeMenuA
GetDialogBaseUnits
keybd_event
GetWindowContextHelpId
ReleaseCapture
GetInputState
SendMessageTimeoutW
WinHelpA
AppendMenuA
InsertMenuItemW

kernel32

ExitProcess
VirtualFree
GetConsoleCursorInfo
SetErrorMode
PeekConsoleInputW
GetPrivateProfileStringW
IsBadStringPtrA
SetEvent
MultiByteToWideChar
GetProfileIntA
GenerateConsoleCtrlEvent
GetThreadPriority
SearchPathW
GetCommModemStatus
GlobalDeleteAtom
GetUserDefaultLangID
SetFileAttributesA
CompareStringA
OpenMutexA
GetEnvironmentStringsW
SetFileTime
OpenFile
GetSystemTime
QueryDosDeviceA
SetVolumeLabelA
GetNumberFormatW
_lread
InitializeCriticalSection
GetCompressedFileSizeW
GetCPInfo
VirtualAlloc
DuplicateHandle
LocalLock
MoveFileExA
ReadFile
GetThreadContext
EnumCalendarInfoA
SetCommTimeouts
OpenSemaphoreW
LoadLibraryExA
GlobalGetAtomNameW
lstrcmpiA
AllocConsole
SetProcessWorkingSetSize
ReadConsoleA
WritePrivateProfileStringW
VirtualProtect
GetOverlappedResult
SetProcessAffinityMask
SetConsoleTitleA
WritePrivateProfileSectionA
_lopen
RaiseException
GetFileAttributesExA
GetFileInformationByHandle

advapi32

RegSaveKeyA
QueryServiceObjectSecurity
CryptImportKey
SetEntriesInAclW
OpenProcessToken
CryptReleaseContext
LookupAccountSidA
SetNamedSecurityInfoA
EqualSid
GetFileSecurityA

ws2_32

getprotobyname
WSASendDisconnect
WSAStringToAddressA
WSALookupServiceEnd
ntohl
accept
WSASetServiceW
WSAAccept
htonl

oleaut32

VariantCopy
QueryPathOfRegTypeLi
SafeArrayGetLBound

version

GetFileVersionInfoSizeA
VerQueryValueA
VerInstallFileA

comctl32

CreatePropertySheetPageA

shell32

FindExecutableW
SHGetSpecialFolderLocation
Shell_NotifyIconW
FindExecutableA

msvcrt

_cexit
fopen
_wtoi
_fullpath
strpbrk
_ultow
calloc
_ui64tow
_dup

Sections

.text
Size: 3KB - Virtual size: 219KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 295KB - Virtual size: 295KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4bd80aef9c4a294187de4511b5e55c21

Headers

File Characteristics

Imports

user32

kernel32

advapi32

ws2_32

oleaut32

version

comctl32

shell32

msvcrt

Sections

.text Size: 3KB - Virtual size: 219KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 295KB - Virtual size: 295KB

.rsrc Size: 17KB - Virtual size: 16KB

.text
Size: 3KB - Virtual size: 219KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 295KB - Virtual size: 295KB

.rsrc
Size: 17KB - Virtual size: 16KB