55760d6702a678d8da1e4b4040862880_JaffaCakes118

General

Target

55760d6702a678d8da1e4b4040862880_JaffaCakes118
Size

104KB
MD5

55760d6702a678d8da1e4b4040862880
SHA1

46e70b39fcc83b8bb9408fa5dc21a6da3756bcb8
SHA256

fc4fe779bece489b0b88e951b3f14aa189d69da7f2c35873fb9b7a43599b6893
SHA512

8aa0d1897267b9552aa7f19cd42f8913a99cb3ad7eb272c628ac5e96d17e9aa0291b58bda3681d366a06262caabcf934f44be7bf6e18914ced34936c6ea13db8
SSDEEP

768:GM6mhf+1EVDMHXMoRg6oQQBTn14SyfGF35EYr+:GOvDAvoQYb143fGF3eYr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
55760d6702a678d8da1e4b4040862880_JaffaCakes118

Files

55760d6702a678d8da1e4b4040862880_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fb131abc7162b8a5fa451b954767ec54

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

nuktopwe.pdb

Imports

untfs

Extend
Format
Recover

kernel32

GetNumberFormatA
InterlockedDecrement
InterlockedExchange
GetCurrentThreadId
CompareStringA
CreateNamedPipeW
FormatMessageA
GetCurrentDirectoryA
VirtualQuery
WriteProcessMemory
GetProcessHeap
GetCurrentProcess
GetPrivateProfileIntA
GetDiskFreeSpaceA
GetComputerNameA
SetLastError
CreateDirectoryA
ExpandEnvironmentStringsA
SleepEx
SystemTimeToFileTime
GetConsoleAliasW
CopyFileA
CreateEventA
LoadLibraryA
GetTimeFormatA
GetFullPathNameA
CreateMutexA
HeapCreate

authz

AuthzFreeAuditEvent
AuthzFreeResourceManager
AuthzFreeContext
AuthzInitializeContextFromSid
AuthzAddSidsToContext

dbnmpntw

ConnectionWrite
ConnectionError
ConnectionVer
ConnectionClose
ConnectionRead

user32

DialogBoxParamW
IsZoomed
IsWindow
GetWindowLongA
GetCaretPos
CharToOemA
LoadImageW
DispatchMessageA
PeekMessageA
GetMessageA
SetCursorPos
IsDialogMessageA
DrawIcon
LoadCursorA
GetWindowTextA
PostMessageA
SetFocus

Sections

.text
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fb131abc7162b8a5fa451b954767ec54

Headers

File Characteristics

PDB Paths

Imports

untfs

kernel32

authz

dbnmpntw

user32

Sections

.text Size: 56KB - Virtual size: 54KB

.data Size: 20KB - Virtual size: 16KB

.rsrc Size: 24KB - Virtual size: 21KB

.text
Size: 56KB - Virtual size: 54KB

.data
Size: 20KB - Virtual size: 16KB

.rsrc
Size: 24KB - Virtual size: 21KB