2cdbb7e6a0eb5bbd90012e21dd65c318_JaffaCakes118

General

Target

2cdbb7e6a0eb5bbd90012e21dd65c318_JaffaCakes118
Size

125KB
MD5

2cdbb7e6a0eb5bbd90012e21dd65c318
SHA1

6c201e6cd2c23409dd041cffdaba41cc52a1bc7f
SHA256

05a75635bc6db83ea1ecce6c0572e829db450fbffaae71ed74c51ac867ac2339
SHA512

0efe295878636b8872f296ee2cec6ac4f43cf74a59e8d02d06a5e3cdc1b2c4c0118d0cb2dd0a88d070ec79945f694caa98eb1b14df75e25556f60b631cf3e25f
SSDEEP

3072:nTTjceFn/r18y7DWMOyIcOR1wnz6H9WKxQEMz:nTTj/n58y2MOjci6zIC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2cdbb7e6a0eb5bbd90012e21dd65c318_JaffaCakes118

Files

2cdbb7e6a0eb5bbd90012e21dd65c318_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a4348df7644b52b96a05a932316b554f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpyW
VirtualProtect
GetFileAttributesW
GetModuleFileNameW
GetLastError
GetModuleHandleA
OpenMutexW
WaitForSingleObject
GetTimeZoneInformation
lstrcmpiW
GetSystemTimeAsFileTime
GetVersionExW
GetProcAddress
GetLocalTime
lstrcatW
VirtualAlloc

shlwapi

PathFileExistsW
wnsprintfW
StrCmpNIA
PathMatchSpecW
wvnsprintfA
PathFindFileNameW
wnsprintfA
PathCombineW
SHDeleteKeyA
PathRemoveFileSpecW
StrCmpNIW

advapi32

CryptHashData
CryptReleaseContext
GetUserNameW
RegQueryValueExA
CryptAcquireContextW
RegDeleteValueA
CryptCreateHash
RegSetValueExA
DuplicateTokenEx
CryptDestroyHash
RegCreateKeyExA

user32

GetForegroundWindow
GetIconInfo
PeekMessageA
MsgWaitForMultipleObjects
FindWindowExA
GetWindowTextA
OpenDesktopA
GetDlgItem
SetThreadDesktop
GetMessageA
GetWindowThreadProcessId
CharLowerBuffA
ExitWindowsEx
SetProcessWindowStation
GetClipboardData
LoadCursorA
GetClassNameA

Sections

.text
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a4348df7644b52b96a05a932316b554f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shlwapi

advapi32

user32

Sections

.text Size: 65KB - Virtual size: 65KB

.data Size: 1KB - Virtual size: 9KB

.rdata Size: 1024B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.text
Size: 65KB - Virtual size: 65KB

.data
Size: 1KB - Virtual size: 9KB

.rdata
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB