3bda901ed8ae54b78a3190f9033a42d1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3bda901ed8ae54b78a3190f9033a42d1_JaffaCakes118
Size

280KB
MD5

3bda901ed8ae54b78a3190f9033a42d1
SHA1

7b66202211556d86994fb3188ccea90146ea5a68
SHA256

7868aef865acbce96afe6f5fee5523772aa0dcb0805d17022d11ed0511bc1dea
SHA512

d2cc10b9680110972d91f9034ffce60be40c3bb0b3d31e2f74c234ef2b9f07e17974d014fd015bdf7a0407dd3f81658d9673ab66286f60f7f3d59e2121a27292
SSDEEP

6144:AFTCjuIUqAcminCdQeneZ/EboV/3PGAco1QAGXICDHpqQquW4Z0O3JB:5qfq5UnK/Wo/fBrmBHo3ZeJB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3bda901ed8ae54b78a3190f9033a42d1_JaffaCakes118

Files

3bda901ed8ae54b78a3190f9033a42d1_JaffaCakes118
.exe windows:5 windows x86 arch:x86

88b1dcd572b0cddaef6167a0573cd521

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

_adjust_fdiv
__dllonexit
__wgetmainargs
wcscmp
_controlfp
malloc
__setusermatherr
__p__fmode
_beginthreadex
_exit
_except_handler3
_ftol
__p__commode
exit
wcscpy

ole32

CoInitializeEx
CoUninitialize
CoTaskMemAlloc
CoCreateInstance

user32

EqualRect
GetUserObjectInformationW
CallWindowProcW
EnumDisplayMonitors
FillRect
GetPropW
GetClientRect
MonitorFromPoint
WindowFromPoint
GetDesktopWindow
DestroyIcon
GetSysColorBrush
InflateRect
CreateWindowExW
CharNextW
UnregisterDeviceNotification
GetDoubleClickTime
LoadImageW
GetSystemMetrics
MonitorFromWindow
GetAncestor
SetThreadDesktop
PostMessageW
LoadStringW

atl

ord58
ord17

gdi32

GetDeviceCaps
SelectObject
DeleteObject

setupapi

SetupDiOpenDevRegKey
SetupDiEnumDeviceInfo
SetupDiGetClassDevsExW
SetupDiGetDeviceInterfaceDetailW

advapi32

OpenThreadToken
RegOpenKeyExA
SetSecurityDescriptorOwner
RegQueryValueExW
GetTokenInformation
SetSecurityDescriptorDacl
RegOpenKeyW
RegCreateKeyW
RegQueryValueExA
RegOpenKeyExW

kernel32

GetTickCount
QueryPerformanceFrequency
lstrlenW
CancelWaitableTimer
GetProcAddress
MapViewOfFile
GetOverlappedResult
ReadFile
OpenEventW
GetCurrentThread
GetTickCount
WaitForMultipleObjectsEx
SetThreadExecutionState
LoadLibraryW
HeapFree
GlobalDeleteAtom
SetPriorityClass
DuplicateHandle
CloseHandle
WaitForSingleObject
GetCurrentProcess
CompareStringW
UnmapViewOfFile
lstrcpyW
CloseHandle
VerifyVersionInfoW
EnterCriticalSection
WaitForMultipleObjects
GetSystemDirectoryW
GetProcessShutdownParameters
VirtualFree
GetModuleHandleA
SetProcessShutdownParameters
VirtualAllocEx
ReleaseMutex
CreateWaitableTimerW
InitializeCriticalSection

hid

HidP_GetCaps
HidD_GetPreparsedData

Sections

.text
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 584KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

88b1dcd572b0cddaef6167a0573cd521

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ole32

user32

atl

gdi32

setupapi

advapi32

kernel32

hid

Sections

.text Size: 177KB - Virtual size: 177KB

.data Size: 71KB - Virtual size: 70KB

.rsrc Size: 30KB - Virtual size: 584KB

.text
Size: 177KB - Virtual size: 177KB

.data
Size: 71KB - Virtual size: 70KB

.rsrc
Size: 30KB - Virtual size: 584KB