404256273e881f489137cd1bc13f15fc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

404256273e881f489137cd1bc13f15fc_JaffaCakes118
Size

116KB
MD5

404256273e881f489137cd1bc13f15fc
SHA1

530d5fe9153a608afe883bc62cd5a869e33a6c2c
SHA256

bc1f74ea277ca71928cf4928641308888f920bb825034b2af7a00c494a703889
SHA512

8e8b804dc59bfc4b9898e59afa81bef6bb880407ae57ec49e86be3fa8a6d17fcb4f9d68b0b1c1010315b68fe16f2cee9e3d5cb6326ca657b63c1885fd333b7b3
SSDEEP

3072:VhnDxBelZadd4tYnRZi0deelocCcr21L+umPQKW:VND/IZav4tYn+OeeLhe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
404256273e881f489137cd1bc13f15fc_JaffaCakes118

Files

404256273e881f489137cd1bc13f15fc_JaffaCakes118
.exe windows:4 windows x86 arch:x86

850b403fb0833f60e122ea30725e0002

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

W:\NMC\Alt\WZRel90\WinZip\WZQKPICK\wzqkpick.pdb

Imports

kernel32

lstrcmpiA
GlobalFindAtomA
WinExec
GlobalDeleteAtom
GlobalAddAtomA
GetTempPathA
GetShortPathNameA
lstrcpynA
lstrcatA
lstrcpyA
IsDBCSLeadByte
lstrlenA
FindFirstFileA
FindClose
GetTickCount
GetVersionExA
FlushFileBuffers
SetStdHandle
SetFilePointer
SetConsoleCtrlHandler
HeapReAlloc
HeapAlloc
LCMapStringW
LCMapStringA
GetLocaleInfoA
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapValidate
IsBadReadPtr
IsBadWritePtr
GetStringTypeW
GetStringTypeA
InterlockedIncrement
OutputDebugStringA
InterlockedDecrement
DebugBreak
WriteFile
VirtualFree
HeapFree
HeapCreate
HeapDestroy
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
CloseHandle
GetOEMCP
GetACP
CompareStringW
GetLastError
CompareStringA
GetCPInfo
MultiByteToWideChar
GetProcAddress
LoadLibraryA
ExitProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
RtlUnwind

advapi32

RegOpenKeyA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegCreateKeyA
RegDeleteKeyA
RegOpenKeyExA
RegCloseKey
RegQueryValueA

user32

CreateDialogParamA
GetMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
UnhookWindowsHook
SetDlgItemTextA
GetSystemMetrics
SendMessageA
RegisterWindowMessageA
ShowWindow
DestroyWindow
PostQuitMessage
KillTimer
DialogBoxParamA
SetFocus
GetDoubleClickTime
GetCursorPos
CreatePopupMenu
SetForegroundWindow
TrackPopupMenuEx
PostMessageA
DestroyMenu
CheckRadioButton
GetDlgItem
EnableWindow
EndDialog
IsDlgButtonChecked
SetTimer
LoadImageA
DrawIconEx
DestroyIcon
IsWindow
GetClassNameA
MessageBoxA
LoadStringA
InsertMenuA
CharNextA
wsprintfA
SetWindowsHookA

shell32

Shell_NotifyIconA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

850b403fb0833f60e122ea30725e0002

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

user32

shell32

Sections

.text Size: 64KB - Virtual size: 63KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 9KB

.rsrc Size: 32KB - Virtual size: 30KB

.text
Size: 64KB - Virtual size: 63KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 9KB

.rsrc
Size: 32KB - Virtual size: 30KB