29aca3f41549a8fe6550beaaef87111d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

29aca3f41549a8fe6550beaaef87111d_JaffaCakes118
Size

208KB
MD5

29aca3f41549a8fe6550beaaef87111d
SHA1

56ff6f3814b6772cabe4229d6518bf6f45eec181
SHA256

6a32119d5e04133d88e3a7b583280f90f326b32012725d640ac92748aee536d8
SHA512

908b932162e7d704bdd13587197b362ecfaf34da1f25d39d0a0467e270f5b91a050e6a84a9824f7889c67fc2f36abe399143e0d959d2167d5f99816d583622b7
SSDEEP

6144:hRrq59JR5yLyYUC1HcypSRDdzyuKMAsn8:hRu5zmyYUyHccSRD4LMAs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29aca3f41549a8fe6550beaaef87111d_JaffaCakes118

Files

29aca3f41549a8fe6550beaaef87111d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

38465c6b5b05236f8a6d6a21b0876883

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHSetValueA
PathIsContentTypeA
SHGetValueA
PathGetCharTypeA
PathFileExistsA
SHStrDupA
SHDeleteKeyA

comctl32

ImageList_Draw

advapi32

RegDeleteValueA

oleaut32

RegisterTypeLib
VariantCopyInd
SafeArrayCreate
SysFreeString
SafeArrayGetUBound
SysReAllocStringLen
SafeArrayPtrOfIndex
VariantChangeType

kernel32

VirtualFree
GetCommandLineW
WriteFile
WideCharToMultiByte
IsBadReadPtr
ExitThread
LoadLibraryA
GetProcAddress
lstrlenA
LoadLibraryExA
GetModuleHandleA
IsBadHugeReadPtr
VirtualAlloc
GetACP
VirtualQuery
LocalAlloc
ExitProcess
lstrcpyA
WaitForSingleObject

version

VerQueryValueA
GetFileVersionInfoA
VerFindFileA
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

user32

GetMenuItemID
GetScrollInfo

gdi32

BitBlt
RestoreDC
GetDCOrgEx
GetCurrentPositionEx
GetDIBits
CreateFontIndirectA
SetBkMode
GetDIBColorTable

shell32

SHGetSpecialFolderLocation
SHGetFileInfoA
SHGetDesktopFolder
SHGetDiskFreeSpaceA
SHFileOperationA

msvcrt

log
strncmp
memcmp

ole32

GetHGlobalFromStream
CreateStreamOnHGlobal
CoFreeUnusedLibraries
CoTaskMemFree

comdlg32

GetSaveFileNameA

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 132KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.hdata
Size: 4KB - Virtual size: 865B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

38465c6b5b05236f8a6d6a21b0876883

Headers

File Characteristics

Imports

shlwapi

comctl32

advapi32

oleaut32

kernel32

version

user32

gdi32

shell32

msvcrt

ole32

comdlg32

Sections

.text Size: 44KB - Virtual size: 43KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 132KB - Virtual size: 225KB

.hdata Size: 4KB - Virtual size: 865B

DATA Size: 8KB - Virtual size: 7KB

.adata Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 832B

.text
Size: 44KB - Virtual size: 43KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 132KB - Virtual size: 225KB

.hdata
Size: 4KB - Virtual size: 865B

DATA
Size: 8KB - Virtual size: 7KB

.adata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 832B