2f5b083d63ed782ad724d9a120f7cb44_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2f5b083d63ed782ad724d9a120f7cb44_JaffaCakes118
Size

390KB
MD5

2f5b083d63ed782ad724d9a120f7cb44
SHA1

66b7af482dfa37634c212b10c953380d5a6cc94c
SHA256

6b4f2c3cad274c3ebd3304c13f8de63954fd4fa3dba964839d9780601e63a853
SHA512

245990fd782d4a22997da5b5d269e560be6ee48f07507ce7ced49ec9a13507fda8c4af302a55306c290b83e98336bc95cd0a16a0d6e08825df258e19b675428a
SSDEEP

12288:ebcp3K0MZre5MahHeCnIbYtGu2nyJb+U90/KDnJbg:40MMPhHbnIbYYny0XKDn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f5b083d63ed782ad724d9a120f7cb44_JaffaCakes118

Files

2f5b083d63ed782ad724d9a120f7cb44_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5a574309c6b3c7bccba7d29c5f37adc3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\pressAfter\spelltell.pdb

Imports

user32

MessageBoxA
LoadImageA
SendMessageA
GetWindowDC
ReleaseDC
ShowCaret
UpdateWindow
EnableScrollBar
ShowScrollBar
GetDesktopWindow
InvalidateRect
GetWindowRect
FindWindowA
PostMessageA
BringWindowToTop
GetParent
EnableWindow
GetForegroundWindow
LoadStringA
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
DrawIconEx
FillRect
InflateRect
CopyRect
DrawStateA
ReleaseCapture
SetCapture
GetActiveWindow
GetLastActivePopup
SetForegroundWindow
GetKeyState
GetCursorPos
SystemParametersInfoA
SendNotifyMessageA
KillTimer
ScreenToClient
PtInRect
IsRectEmpty
SetWindowLongA
SetCursor
LoadCursorA
SetRectEmpty
GetSystemMetrics
TranslateAcceleratorA
MapDialogRect
SetRect
SetTimer
LoadIconA
DestroyIcon
GetDC
MsgWaitForMultipleObjects
TranslateMessage
DispatchMessageA
PeekMessageA
GetClassNameA
GetClassLongA
SetClassLongA
IsChild
GetClientRect
OffsetRect

advapi32

RegDeleteValueA
FreeSid
DuplicateTokenEx
ImpersonateLoggedOnUser
SetThreadToken
RegOpenKeyExA
RegQueryValueExA
AddAce
GetAclInformation
IsValidSid
CopySid
GetTokenInformation
LookupAccountSidA
GetSecurityInfo
GetSecurityDescriptorDacl
GetUserNameA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetSecurityInfo
CreateProcessAsUserA
AddAccessAllowedAce
RegCreateKeyExA
RegSetValueExA
ImpersonateSelf
OpenThreadToken
OpenProcessToken
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
RegCloseKey
DecryptFileA
FileEncryptionStatusA
GetAce
RevertToSelf
AccessCheck
IsValidSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl

comdlg32

GetOpenFileNameA

comctl32

_TrackMouseEvent

kernel32

FindFirstFileA
FindNextFileA
FindClose
GetProcAddress
FormatMessageA
GetDateFormatA
GetCurrentThread
GetCurrentProcess
LocalAlloc
CreateDirectoryA
FindResourceA
VerifyVersionInfoA
LockResource
GetModuleFileNameA
MulDiv
WaitForSingleObject
LoadLibraryA
CreateThread
GetFileAttributesA
CopyFileA
GetCurrentProcessId
VerSetConditionMask
TerminateProcess
GetWindowsDirectoryA
VirtualProtect
SetTapeParameters
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
HeapCreate
VirtualFree
FatalAppExitA
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
IsBadWritePtr
RtlUnwind
VirtualQuery
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetSystemInfo
GetTimeZoneInformation
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetSystemTime
CreateProcessA
LoadResource
UnlockFile
GetStartupInfoA
GlobalFree
GlobalAlloc
GetComputerNameA
CreateMutexA
CreateFileA
WriteFile
FindResourceExA
SizeofResource
IsDebuggerPresent
SystemTimeToFileTime
GetTickCount
GetTimeFormatA
FileTimeToSystemTime
GetCurrentThreadId
LocalFileTimeToFileTime
SetFilePointer
TryEnterCriticalSection
LockFile
InitializeCriticalSection
TerminateThread
LeaveCriticalSection
ExitThread
MoveFileA
EnterCriticalSection
GetFileTime
DeleteCriticalSection
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
WideCharToMultiByte
lstrlenA
GetFullPathNameA
lstrcmpiA
SetFileTime
DosDateTimeToFileTime
ReleaseMutex
OpenMutexA
ReadFile
GetFileSize
SetErrorMode
InterlockedExchange
InterlockedCompareExchange
HeapSetInformation
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
OpenProcess
ExpandEnvironmentStringsA
InitializeCriticalSectionAndSpinCount
RaiseException
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetLastError
LocalFree
GetLocalTime
MultiByteToWideChar
LoadLibraryExA
GetModuleHandleA
SetLastError
WritePrivateProfileStringA
GetPrivateProfileStringA
DeleteFileA
SetEvent
ResetEvent
FreeLibrary
GetVersionExA
GetLocaleInfoA
OutputDebugStringA
GetTempPathA
Sleep
GetCommandLineA
CloseHandle
CreateEventA
QueryPerformanceCounter
GetExitCodeProcess

Sections

.text
Size: 299KB - Virtual size: 298KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5a574309c6b3c7bccba7d29c5f37adc3

Headers

File Characteristics

PDB Paths

Imports

user32

advapi32

comdlg32

comctl32

kernel32

Sections

.text Size: 299KB - Virtual size: 298KB

.rdata Size: 47KB - Virtual size: 46KB

.data Size: 41KB - Virtual size: 108KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 299KB - Virtual size: 298KB

.rdata
Size: 47KB - Virtual size: 46KB

.data
Size: 41KB - Virtual size: 108KB

.rsrc
Size: 1KB - Virtual size: 1KB