16ddd996ed250ad39efc9be7457aea32_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

16ddd996ed250ad39efc9be7457aea32_JaffaCakes118
Size

282KB
MD5

16ddd996ed250ad39efc9be7457aea32
SHA1

0cf1d96cea988ce89e2542ec399b6b268a5ff287
SHA256

c5e493888d81af3f9928519d9e75920b245e8841a0ceace5ac0ee9afa23f1c17
SHA512

1f81673315a2b9f6876abe4b57f0536eee95f6e5a76ee205e9bcafb971e4506a932ce26a60a319a069af12ed78f218272f7bc8d3966eefd62ccfcb2ff4c93c42
SSDEEP

3072:R+vi7nzb5pFQ2hjDfYwX9PPTRpKK353oW3x6jzOm60uyDfLUqcDADxm7/9Sh8HCH:bb5p7hlaE53oWUKm5uyXUqVpCQBa8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16ddd996ed250ad39efc9be7457aea32_JaffaCakes118

Files

16ddd996ed250ad39efc9be7457aea32_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7fd58671a185f40ba03babe78f4a6d98

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\n

Imports

kernel32

IsValidCodePage
FlushFileBuffers
GetTickCount
CompareStringA
GetModuleFileNameA
FreeEnvironmentStringsW
GetModuleHandleA
HeapSize
IsBadWritePtr
WriteFile
HeapDestroy
GetVersionExA
CloseHandle
LocalFree
WideCharToMultiByte
OpenEventW
RtlUnwind
TerminateProcess
EnterCriticalSection
GetStringTypeExW
VirtualFree
LCMapStringA
EnumSystemLocalesA
GetEnvironmentStringsW
SetLastError
GetEnvironmentVariableW
WritePrivateProfileStringA
GetLocaleInfoA
HeapAlloc
SetEnvironmentVariableA
GetProcAddress
HeapFree
TlsGetValue
WriteConsoleOutputW
GetOEMCP
GetTimeZoneInformation
EnumCalendarInfoExW
QueryPerformanceCounter
GetCurrentProcessId
ExitProcess
FindNextFileA
HeapReAlloc
VirtualAlloc
VirtualProtect
GetSystemInfo
LCMapStringW
SetHandleCount
GetProfileSectionA
GetStringTypeW
GetTimeFormatA
SetFilePointer
GetCPInfo
WritePrivateProfileStructA
LeaveCriticalSection
CompareStringW
GetCurrentThreadId
GetDateFormatA
UnhandledExceptionFilter
GetEnvironmentStrings
InitializeCriticalSection
TlsFree
SetLocaleInfoA
GetStdHandle
IsValidLocale
TlsAlloc
GetCurrentProcess
TlsSetValue
GetStartupInfoA
ReadFile
VirtualQuery
GetUserDefaultLCID
GetLocaleInfoW
GetCommandLineA
LoadLibraryA
DeleteCriticalSection
HeapCreate
CreateMutexA
GetStringTypeA
SetStdHandle
GetDiskFreeSpaceExW
GetCurrentThread
GetFileType
GlobalAlloc
EnumSystemCodePagesW
InterlockedExchange
GetLastError
MultiByteToWideChar
ExpandEnvironmentStringsA
OpenMutexA
FreeEnvironmentStringsA
GetSystemTimeAsFileTime
GetACP

comctl32

ImageList_Merge
ImageList_Remove
ImageList_EndDrag
ImageList_DragLeave
CreateMappedBitmap
DrawStatusTextA
ImageList_GetDragImage
ImageList_GetIcon
InitCommonControlsEx
ImageList_SetDragCursorImage
ImageList_LoadImageA
ImageList_Duplicate
CreateStatusWindow
ImageList_SetIconSize
ImageList_SetBkColor
ImageList_Replace
CreatePropertySheetPageA
DrawStatusTextW
ImageList_Add
ImageList_BeginDrag
ImageList_Copy
ImageList_LoadImage
MakeDragList

user32

PtInRect
MessageBoxW
CreateWindowExW
ShowWindow
EnumWindowStationsA
RegisterClassExA
DefMDIChildProcW
ChildWindowFromPointEx
SetCaretBlinkTime
SetMenuItemInfoW
RegisterWindowMessageW
RegisterClassA

Sections

.text
Size: 167KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7fd58671a185f40ba03babe78f4a6d98

Headers

File Characteristics

PDB Paths

Imports

kernel32

comctl32

user32

Sections

.text Size: 167KB - Virtual size: 167KB

.rdata Size: 16KB - Virtual size: 38KB

.data Size: 87KB - Virtual size: 86KB

.rsrc Size: 10KB - Virtual size: 9KB

.text
Size: 167KB - Virtual size: 167KB

.rdata
Size: 16KB - Virtual size: 38KB

.data
Size: 87KB - Virtual size: 86KB

.rsrc
Size: 10KB - Virtual size: 9KB