173a6a442ab06d4b66d88f25ad0af9a0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

173a6a442ab06d4b66d88f25ad0af9a0_JaffaCakes118
Size

558KB
MD5

173a6a442ab06d4b66d88f25ad0af9a0
SHA1

95109d1f465d3076cf5ba5f88db2f85cee212096
SHA256

43d22203bb39acd875df81661fc67da0cee36f47d75d12b99f3537f1d34215d0
SHA512

a7bf74a1682818f99da46693ed4fa9eeb7f211849b60d75cd1f29b1d1a0440339980d165760ceac5e6f1c68cb0754a89201cfa788fff7d4da431135b4b75a809
SSDEEP

12288:NA9+Rn6S2koV5doR9t4RYVWRyQIx8CLpeUdnHvnxnq:PpMV5dobW3RyvxRwOnPnxnq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
173a6a442ab06d4b66d88f25ad0af9a0_JaffaCakes118

Files

173a6a442ab06d4b66d88f25ad0af9a0_JaffaCakes118
.exe windows:5 windows x86 arch:x86

ba61eef3f0de57680d6a1a4bd3ffb5ad

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
WaitForMultipleObjects
CreateEventW
OpenEventA
GetSystemDirectoryW
WaitForSingleObject
GetProcAddress
GetModuleHandleW
LoadResource
FindResourceW
GetLocalTime
GetSystemTime
GetComputerNameW
GetCurrentProcessId
VirtualAlloc
LoadLibraryA
IsBadReadPtr
GetProcessHeap
HeapAlloc
VirtualFree
HeapFree
FreeLibrary
LockResource
FindResourceExW
GetCurrentThreadId
WideCharToMultiByte
GetCommandLineW
GetStringTypeW
LoadLibraryW
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
WriteFile
MultiByteToWideChar
LCMapStringW
SizeofResource
OpenEventW
GetVersion
OpenMutexA
OpenMutexW
GetModuleFileNameW
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
EnterCriticalSection
LeaveCriticalSection
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
RtlUnwind
EncodePointer
DecodePointer
HeapSetInformation
GetStartupInfoW
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
Sleep
ExitProcess
HeapCreate
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage

user32

GetFocus
GetCursor
ChildWindowFromPoint
GetWindow
IsIconic
IsWindowVisible
AdjustWindowRect
GetSysColorBrush
IsWindowUnicode
IsWindow
GetSystemMetrics
GetSysColor
GetParent
GetClientRect
GetWindowRect
IsZoomed
GetForegroundWindow
GetDesktopWindow
IsChild

gdi32

PtInRegion
CreatePolygonRgn
GetRgnBox
DeleteObject
GetStockObject

Sections

.text
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 423KB - Virtual size: 423KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ba61eef3f0de57680d6a1a4bd3ffb5ad

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

Sections

.text Size: 91KB - Virtual size: 90KB

.rdata Size: 19KB - Virtual size: 18KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 423KB - Virtual size: 423KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 91KB - Virtual size: 90KB

.rdata
Size: 19KB - Virtual size: 18KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 423KB - Virtual size: 423KB

.reloc
Size: 8KB - Virtual size: 7KB