2ae89bebaca1f0e969195f6eefdfcd3c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2ae89bebaca1f0e969195f6eefdfcd3c_JaffaCakes118
Size

95KB
MD5

2ae89bebaca1f0e969195f6eefdfcd3c
SHA1

35b22c187b72b8c3b948da2f0fdf8ddb7148b042
SHA256

eeba5e1c6fe6db66e9c37acef306014535f87973cf7bf09fd4ced4041aca4a27
SHA512

4b3fcb0cd590a4e5c2d6595c6fce6aeba9e24dbd09968a62ca030e6eecd3c2f58487c06edbb4badc6a85e326f4400d029e8896a9f018f7b0dd47437a68f01203
SSDEEP

1536:2xdl8glTtbc4ED97TBnX4OqxQG8vkgTzdcdLAvx/4Gc/QCtQbpkcuxgrLQxPS5L2:PEpbc/D6cbTOpAxq/ftQbpkcuxgrLQxP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ae89bebaca1f0e969195f6eefdfcd3c_JaffaCakes118

Files

2ae89bebaca1f0e969195f6eefdfcd3c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

954cba909ae231d68eb980e56660582e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CompareStringA
DeleteFileA
ExitProcess
FindResourceA
GetACP
GetCommandLineA
GetLastError
GetModuleHandleA
GetOEMCP
GetStartupInfoA
GetVersion
HeapAlloc
InitializeCriticalSection
InterlockedIncrement
ReadFile
RtlUnwind
SetErrorMode
SetLastError
WritePrivateProfileSectionA

advapi32

RegEnumKeyA
RegLoadKeyA
RegOpenKeyExA
RegQueryValueA
LookupPrivilegeValueA

ole32

CLSIDFromString
CoCreateInstance
WriteFmtUserTypeStg
CoGetClassObject
CoInitialize
ReleaseStgMedium
CoTaskMemRealloc
RegisterDragDrop
OleUninitialize
OleInitialize
GetConvertStg
CreateILockBytesOnHGlobal
CreateBindCtx
CoUninitialize
CoFileTimeNow
CoRegisterMessageFilter

user32

ToAscii
MessageBoxA
MessageBeep
GetWindowTextA
GetDC
EndPaint
EndDeferWindowPos
EnableWindow
EnableMenuItem
EmptyClipboard
DialogBoxParamA
CreateIconFromResource
CharUpperA
CharToOemA
CharNextA
DrawTextA

shell32

Shell_NotifyIconA
SHGetDesktopFolder
SHGetFileInfoA
SHGetMalloc
ShellExecuteA
ShellExecuteExW
SHFileOperationA

shlwapi

StrChrA
SHAutoComplete
PathIsRootA
PathFindExtensionA
StrStrIA

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionFontA
ImmSetCompositionWindow
ImmGetCompositionStringW

msvcrt

_errno
free
malloc
memmove
strchr
strlen
vsprintf
__set_app_type
fflush

oleaut32

SysAllocStringLen
SysFreeString
SysStringLen
VariantClear
VariantCopyInd
LoadTypeLib

Exports

Exports

Datzhhpeeq
Dg
Fprxo
Hfzhupy
Ixhatbxubc
Msnncv
Opxaodhxf
Pwiw
We
Xayitop

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

954cba909ae231d68eb980e56660582e

Headers

File Characteristics

Imports

kernel32

advapi32

ole32

user32

shell32

shlwapi

imm32

msvcrt

oleaut32

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 34KB - Virtual size: 36KB

.data Size: 25KB - Virtual size: 28KB

.idata Size: 3KB - Virtual size: 4KB

.rsrc Size: 8KB - Virtual size: 8KB

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 34KB - Virtual size: 36KB

.data
Size: 25KB - Virtual size: 28KB

.idata
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 8KB - Virtual size: 8KB