f6a97e1a13631093462460a93808cd02_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f6a97e1a13631093462460a93808cd02_JaffaCakes118
Size

60KB
MD5

f6a97e1a13631093462460a93808cd02
SHA1

2f21b5a2f47ba0654c90a4312c641793efe0a6bd
SHA256

b265f883cad167d464f8116648a1a2b0d8f0ccdcfba6b0806bf0defe1f260a16
SHA512

29c277b3f99fecd50b3ad1aa9f45bcd193022920021b1f442d672ea3abf5e9e0a9fd339623b00de1db66b015cc5904f5b31abc73d28124c6f88092a5c07481c6
SSDEEP

1536:Sw1iiuC1Gn3FXimhvl+tEgkTxXtwsw2mSVZklii7/f:V1iiH1GVPht+tkdbmSVZkliO/f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6a97e1a13631093462460a93808cd02_JaffaCakes118

Files

f6a97e1a13631093462460a93808cd02_JaffaCakes118
.dll windows:4 windows x86 arch:x86

99776d3aa3ba96cc3ac09e0adac4f07b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReadFile
WaitForMultipleObjects
LocalAlloc
DeviceIoControl
CreateEventA
CreateFileA
SetEvent
DuplicateHandle
GetCurrentProcess
CreatePipe
CloseHandle
SetStdHandle
WaitForSingleObject
WriteConsoleW
WriteConsoleA
lstrcmpiA
GetStartupInfoA
CreateProcessA
GetEnvironmentVariableA
GetProcAddress
CreateThread
WriteFile
GetDriveTypeA
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetModuleFileNameA
InitializeCriticalSection
LoadLibraryA
FreeLibrary
DeleteCriticalSection
GetFileAttributesA
lstrcatA
LocalFree
PulseEvent
ReleaseMutex
lstrlenA
GetLastError
ExitThread
GetCommandLineA
CreateMutexA
GlobalUnlock
GlobalLock
lstrcpyA
SetLastError
VirtualProtect
FlushInstructionCache
VirtualQuery
GetModuleHandleA
HeapSize
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetStdHandle
GetSystemDirectoryA
WriteConsoleInputA
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetVersionExA
RtlUnwind
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
ExitProcess
GetSystemInfo
LCMapStringA
MultiByteToWideChar
LCMapStringW
TerminateProcess
SetHandleCount
GetFileType
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
InterlockedExchange
GetACP
GetOEMCP
GetCPInfo

user32

UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
EnumChildWindows
GetClassNameA
GetFocus
GetWindowTextA
GetWindowLongA
GetMessageA
TranslateMessage
DispatchMessageA
RegisterClassA
CreateWindowExA
PostQuitMessage
DefWindowProcA
wsprintfA
GetParent

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor

Sections

.text
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

99776d3aa3ba96cc3ac09e0adac4f07b

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Sections

.text Size: 38KB - Virtual size: 37KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 2KB - Virtual size: 9KB

Shared Size: 512B - Virtual size: 8B

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 38KB - Virtual size: 37KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 2KB - Virtual size: 9KB

Shared
Size: 512B - Virtual size: 8B

.reloc
Size: 6KB - Virtual size: 5KB