411afb171c795cc4fcf7a306619b161d_JaffaCakes118

General

Target

411afb171c795cc4fcf7a306619b161d_JaffaCakes118
Size

116KB
MD5

411afb171c795cc4fcf7a306619b161d
SHA1

f1310bfeb4a033224efff4d1d988a97485ae7a9f
SHA256

eeb107057bf6aff971203b4121b2b2b6abbe5c234bf2b21a4b6c8a622071d9c7
SHA512

73e1912d517d570417cfbb97a533a2d13bf18cb94c5645fabd487d200fc8e9bef0eef7fb2c6d546671c739b9b77a9b50b23228ec5ed4dc84bdf6d1c74ce136c3
SSDEEP

3072:kvNsMGKyQdRbvKGFKgZnSI3RfxHrC1N5h6b7A9:kvNgTaCSZnRUHYu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
411afb171c795cc4fcf7a306619b161d_JaffaCakes118

Files

411afb171c795cc4fcf7a306619b161d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3152758578c0362326b88d22f05f9f79

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

AddAtomA
CallNamedPipeA
FindNextFileA
EnumCalendarInfoW
GetCPInfoExW
OpenThread
AllocConsole
GetTimeFormatW
FindNextVolumeA
FindNextVolumeMountPointW
EraseTape
WritePrivateProfileStructW
FindResourceExA
GetCalendarInfoW
AllocateUserPhysicalPages
GetModuleHandleA
IsBadStringPtrW
GetOverlappedResult
GetLastError
GetPrivateProfileSectionNamesW

msvcrt

_wspawnvp
strcat
_CIpow
_filbuf
__threadid
wcsncpy
vprintf
isupper
fmod
__threadhandle

shell32

Control_RunDLLW
SHCreateDirectoryExA
ExtractAssociatedIconExA
SHBrowseForFolderA
SHIsFileAvailableOffline
RealShellExecuteA
SHFormatDrive
Control_RunDLL
RealShellExecuteW
SHGetDesktopFolder
SHGetFileInfoW
SHChangeNotifySuspendResume
SHGetPathFromIDList
SHGetDataFromIDListW
SHInvokePrinterCommandW
FreeIconList
SHGetFolderPathW
SHEmptyRecycleBinW

shlwapi

SHRegOpenUSKeyW
SHDeleteOrphanKeyW
SHRegisterValidateTemplate
StrPBrkA
SHDeleteEmptyKeyA
PathIsURLA
SHRegDeleteEmptyUSKeyA
StrRChrA
UrlGetLocationW
UrlHashW
UrlUnescapeA
PathIsSameRootW
PathRenameExtensionW
PathSetDlgItemPathA
StrChrA
StrTrimA
PathIsNetworkPathW
PathRemoveFileSpecA
PathParseIconLocationA

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 18B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3152758578c0362326b88d22f05f9f79

Headers

File Characteristics

Imports

kernel32

msvcrt

shell32

shlwapi

Sections

.text Size: 5KB - Virtual size: 4KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 105KB - Virtual size: 105KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 18B

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 105KB - Virtual size: 105KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 18B