a320ac97a815df118c212e31647c3ce6_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

a320ac97a815df118c212e31647c3ce6_JaffaCakes118
Size

178KB
MD5

a320ac97a815df118c212e31647c3ce6
SHA1

56841e85b16d3de4734a80f2731279f1f332f4e7
SHA256

be4979cef77398a3dc5a2c47ac1aeb6677e6502480e6f08bdb773ad9d0ffa141
SHA512

73b04a136813f649258661d6e7ea491e957f6afe2cf8f533115f0091ec11a46e1e3d056acab0a1469a82c7bc5ce3259edaedd84f4a7e7f768c3ec615098a9f47
SSDEEP

3072:E9isA4AaRLdXouF87z2x7zAPV9GH6l6OxQryQ0J0Wspw:kL387zbV9GaOyQvWsq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a320ac97a815df118c212e31647c3ce6_JaffaCakes118

Files

a320ac97a815df118c212e31647c3ce6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c191a1ad9e3c1611917eee0449406686

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

SetTapeParameters
GetCurrentProcessId
ClearCommError
InterlockedExchange
FindClose
Sleep
EnumResourceNamesA
GetWindowsDirectoryA
ExitProcess
GetLocalTime
GetVersion
FindFirstFileA

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

gdi32

SaveDC
GetDeviceCaps
GetTextExtentPoint32A
CreateCompatibleDC
GetStockObject
DeleteMetaFile
CreateFontIndirectA
DeleteObject
SetTextColor
CreateSolidBrush
CreateRectRgn
DeleteDC
SetBkMode
BitBlt
SelectObject
TextOutA
EnumFontFamiliesExA
Rectangle
RestoreDC
GetObjectA
CreateCompatibleBitmap

user32

SetCursor
ReleaseDC
MoveWindow
SetWindowLongA
SetWindowPos
FillRect
ReleaseCapture
GetSysColor
IsWindow
GetWindowInfo
GetWindowLongA
LoadCursorA
GetDlgItem
GetDC
SetCapture

oleacc

LresultFromObject
CreateStdAccessibleObject

winmm

mciSendCommandA
sndPlaySoundA

advapi32

RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegQueryValueExA
RegOpenKeyA
RegCloseKey
RegOpenKeyExA
RegSetValueExA

ole32

CoTaskMemFree
ProgIDFromCLSID
StringFromCLSID

shell32

SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderLocation

Sections

.text
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.lib
Size: 512B - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c191a1ad9e3c1611917eee0449406686

Headers

File Characteristics

Imports

kernel32

version

gdi32

user32

oleacc

winmm

advapi32

ole32

shell32

Sections

.text Size: 150KB - Virtual size: 149KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 24KB - Virtual size: 24KB

.lib Size: 512B - Virtual size: 76KB

.text
Size: 150KB - Virtual size: 149KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 24KB - Virtual size: 24KB

.lib
Size: 512B - Virtual size: 76KB