41475b08146d22544211e665befbbb8d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

41475b08146d22544211e665befbbb8d_JaffaCakes118
Size

141KB
MD5

41475b08146d22544211e665befbbb8d
SHA1

47a46ff5d0818ce6259e0477ba8b5e1f1de39afe
SHA256

c531a46aac08141691ab8a077543344b2a0086dc8730eb058255327e3ed8fcb0
SHA512

7cec96fed203680e6df3795b3aef83309a734d50a353b1a12b5cce08a05df7a461d6a1baace2effcc50fb074bf95f1064a4dd8de7913ac6c54d316b3e1aedccf
SSDEEP

3072:ib4x9KpAq0XolUJKQpWkdGO9969jAiN4Q9p67GiZO0:VcNrlUygbO9jALkcGi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41475b08146d22544211e665befbbb8d_JaffaCakes118

Files

41475b08146d22544211e665befbbb8d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a40fe897dff21cbf247b1333ac9d3ee6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

T:\nogbnrDuxRm\bsqwycxg\qZberrtoorFqg\dpQdara.pdb

Imports

msvcrt

_controlfp
__set_app_type
setlocale
__p__fmode
putc
strchr
wcschr
wcslen
toupper
free
iswdigit
__p__commode
_amsg_exit
remove
srand
isprint
printf
rand
iswprint
wcstok
vswprintf
wcsrchr
strrchr
_vsnwprintf
_initterm
_ismbblead
fclose
_XcptFilter
wcscat
strcpy
tolower
strerror
wcsncpy
ungetc
mbtowc
towlower
fwrite
_exit
wcscoll
_cexit
localtime
wcstod
__setusermatherr
__getmainargs
swscanf
ftell
strcspn
wcstoul

user32

SetScrollPos
GetMenu
SetRectEmpty
CharUpperBuffA
GetClassInfoA
DrawFocusRect
CharLowerW
SetScrollInfo
ToUnicodeEx
DestroyCursor
ChangeMenuW
GetDoubleClickTime
RegisterClassW
OpenIcon
SetSysColors
HiliteMenuItem
IsWindowUnicode
LoadMenuA
DefFrameProcA
DefWindowProcW
SetDlgItemInt
GetSystemMenu
SendMessageTimeoutW
LoadIconW
SetWindowTextW
SwitchToThisWindow
FindWindowW
ShowScrollBar
DragObject
SetActiveWindow
GetMessageA
InvalidateRgn
EnableWindow
ChildWindowFromPointEx
CharNextW
GetClassNameW
CharLowerA
RegisterHotKey
WindowFromPoint
IsZoomed
CreateDialogIndirectParamW
GetCursorPos
RemoveMenu
AttachThreadInput
FillRect
DispatchMessageA
GetFocus
InSendMessageEx
MonitorFromPoint
MessageBoxA
InsertMenuW
CharNextA
EnumThreadWindows
FindWindowExW
CharToOemBuffA
SetWindowPos
ModifyMenuW
CreatePopupMenu
SetWindowLongW
ExitWindowsEx
ScreenToClient
AppendMenuW
OemToCharBuffA
CopyImage
wvsprintfW
DrawMenuBar
CharPrevW
GetKeyboardLayoutNameW
EnumChildWindows
GetMenuStringA
SetForegroundWindow
wsprintfW
MapVirtualKeyA
LoadImageW
GetUpdateRgn
GetWindowTextA
IsCharUpperA
ShowCaret
IsCharAlphaW
RegisterWindowMessageA
GetPropW
MessageBoxW
IsCharAlphaA
GetLastActivePopup
SetWindowPlacement
CheckDlgButton
MessageBoxExW
CharLowerBuffW
GetDlgItemInt
AllowSetForegroundWindow
IsCharLowerA
LoadImageA
LoadAcceleratorsA
IntersectRect
IsDialogMessageW
CreateDialogParamW
DispatchMessageW
LoadBitmapA
RemovePropW
OffsetRect
ShowWindowAsync
SetScrollRange
IsChild
SetWindowTextA
SetCursorPos
CharUpperA
wvsprintfA
GetAsyncKeyState
RedrawWindow
GetMenuState
AdjustWindowRectEx
CascadeWindows
GetDlgItem
InvalidateRect
CheckRadioButton
HideCaret
RegisterClassExW
DefFrameProcW
DrawIcon
SendInput
GetMenuItemInfoW
GetWindowDC
SetWindowRgn

comdlg32

PrintDlgW
GetOpenFileNameW
ChooseFontW
PrintDlgExW
GetSaveFileNameW
GetFileTitleW

kernel32

GetSystemTimeAsFileTime
IsDBCSLeadByteEx
GetVersionExA
lstrlenW
GetThreadLocale
GetShortPathNameA
IsBadCodePtr
LeaveCriticalSection
ExitThread
GetOverlappedResult
SetThreadLocale
GetTimeZoneInformation
GetFileAttributesExW
SleepEx
FoldStringW
GetStartupInfoW
SetCommBreak
CompareStringW
CopyFileA
ReleaseMutex
WaitCommEvent
WaitForSingleObjectEx
FindResourceW
SetWaitableTimer
GetBinaryTypeW
lstrcpynW
GlobalAlloc
GetTempPathW
GetModuleHandleA
SearchPathW
FindCloseChangeNotification
ResumeThread
WaitForMultipleObjects
SetThreadContext
AreFileApisANSI
CreateThread
EnumResourceNamesA
CreateRemoteThread
EnumResourceLanguagesA
VirtualQuery
HeapSize
GetStartupInfoA
FindResourceExA
GetTickCount
lstrcatA
UnmapViewOfFile
QueryDosDeviceW
GetStringTypeExW
GlobalFindAtomW
OpenFileMappingA
GlobalAddAtomA
SetFileApisToOEM
FindNextFileW
SizeofResource
GetModuleFileNameA
SuspendThread
SetFilePointer
MapViewOfFile
GetAtomNameA

shlwapi

UrlGetPartW

Exports

Exports

?CreatDlgItemList@@YGKPBDDPAX:O

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.exp
Size: 512B - Virtual size: 121B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edit
Size: 1KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ixport
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sims
Size: 512B - Virtual size: 330B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ndat
Size: 1024B - Virtual size: 704B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a40fe897dff21cbf247b1333ac9d3ee6

Headers

File Characteristics

PDB Paths

Imports

msvcrt

user32

comdlg32

kernel32

shlwapi

Exports

Exports

Sections

.text Size: 22KB - Virtual size: 22KB

.exp Size: 512B - Virtual size: 121B

.edit Size: 1KB - Virtual size: 123KB

.data Size: 2KB - Virtual size: 2KB

.ixport Size: 6KB - Virtual size: 5KB

.sims Size: 512B - Virtual size: 330B

.ndat Size: 1024B - Virtual size: 704B

.rsrc Size: 105KB - Virtual size: 105KB

.text
Size: 22KB - Virtual size: 22KB

.exp
Size: 512B - Virtual size: 121B

.edit
Size: 1KB - Virtual size: 123KB

.data
Size: 2KB - Virtual size: 2KB

.ixport
Size: 6KB - Virtual size: 5KB

.sims
Size: 512B - Virtual size: 330B

.ndat
Size: 1024B - Virtual size: 704B

.rsrc
Size: 105KB - Virtual size: 105KB