57060d5a89bba8cfc4d94d8d9063a41f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

57060d5a89bba8cfc4d94d8d9063a41f_JaffaCakes118
Size

132KB
MD5

57060d5a89bba8cfc4d94d8d9063a41f
SHA1

07da47e8391548a608c1883379fe3865eedb700b
SHA256

c0808579f5f6cf125e85ef5b4503af3ba06db3c72f6ac4105d4ecd4f3f7e47ad
SHA512

3e306d45abedef32e202827d5d0bf47c471e650e0e38e8e45ef60c07bae196a627db1f9481ddd56125e469ed74e912d4f444abba0371ab3d759f6993312d01b5
SSDEEP

3072:GZl6k49NyLsp/w96ef8umulkukQ6Z0Ao/0kXmXMUHnenrd2l:kMfNF/v9Z0Z5UH24

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
57060d5a89bba8cfc4d94d8d9063a41f_JaffaCakes118

Files

57060d5a89bba8cfc4d94d8d9063a41f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

47954b40735259cfea508f41718ef692

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegSetValueExW
RegCreateKeyExA
RegCreateKeyExW
RegEnumValueA
RegEnumValueW
RegOpenKeyA
RegOpenKeyW
RegDeleteKeyA
RegDeleteKeyW
RegDeleteValueA
RegDeleteValueW
RegOpenKeyExA
RegOpenKeyExW
RegQueryInfoKeyA
RegQueryInfoKeyW
RegEnumKeyExA
RegSetValueExA
RegEnumKeyExW
RegCloseKey

kernel32

LeaveCriticalSection
GetProcAddress
HeapDestroy
GetLastError
LoadResource
SizeofResource
lstrlenA
FreeLibrary
EnterCriticalSection
InterlockedIncrement
GetCommandLineW
GetCurrentThreadId
InitializeCriticalSection
Sleep
DeleteCriticalSection
CreateThread
WaitForSingleObject
CloseHandle
InterlockedDecrement
SetEvent
GetStartupInfoW
lstrcatW
LoadLibraryExW
CreateMutexW
CreateMutexA
GetShortPathNameA
LoadLibraryExA
LoadLibraryA
lstrcpynW
GetModuleHandleW
GetModuleFileNameW
GetModuleFileNameA
FindResourceW
FindResourceA
CreateEventW
CreateEventA
SetLastError
LoadLibraryW
DeleteFileW
IsBadWritePtr
GetShortPathNameW
lstrcpyW
FreeLibraryAndExitThread
WideCharToMultiByte
CreateFileW
GetTempFileNameW
GetTempPathW
WriteFile
lstrcmpiA
lstrcmpiW
GlobalLock
GlobalUnlock
GetVersionExA
lstrlenW
MultiByteToWideChar

ole32

CoRegisterClassObject
CoRevokeClassObject
CoInitializeEx
CoUninitialize
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoResumeClassObjects
ReleaseStgMedium
CoCreateInstance
CoSuspendClassObjects

oleaut32

VarUI4FromStr
SysAllocString
RegisterTypeLi
LoadTypeLi
SysFreeString

shlwapi

StrRetToBufW

shell32

ShellExecuteExW
SHGetDesktopFolder
DragQueryFileW

msvcrt

_purecall
_controlfp
_onexit
__dllonexit
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_XcptFilter
_exit
memmove
_wsplitpath
wcslen
_wcslwr
free
realloc
malloc
??2@YAPAXI@Z
??3@YAXPAX@Z

user32

GetWindow
IsWindowVisible
GetWindowThreadProcessId
GetDesktopWindow
GetParent
ShowWindow
IsIconic
SetForegroundWindow
SendMessageTimeoutA
SendMessageA
CharNextW
PostThreadMessageW
PostThreadMessageA
FindWindowW
RegisterClipboardFormatW
RegisterWindowMessageA
GetMessageA
DispatchMessageA
DispatchMessageW
FindWindowA
GetMessageW

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

47954b40735259cfea508f41718ef692

Headers

File Characteristics

Imports

advapi32

kernel32

ole32

oleaut32

shlwapi

shell32

msvcrt

user32

Sections

.text Size: 24KB - Virtual size: 23KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 64KB - Virtual size: 65KB

.rsrc Size: 32KB - Virtual size: 28KB

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 64KB - Virtual size: 65KB

.rsrc
Size: 32KB - Virtual size: 28KB