fdecfb4064a2e20419bbeb74cabf4dbe_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fdecfb4064a2e20419bbeb74cabf4dbe_JaffaCakes118
Size

277KB
MD5

fdecfb4064a2e20419bbeb74cabf4dbe
SHA1

7bbb1ce78dda1410f6baf3952621b098b57146c2
SHA256

ec5ed252e2a83cb5e5e7e92b36d10e0dc7f63fd7528bac1c515440822821952e
SHA512

3d2f1c077b12e30095868e746a668f2c4d77bfa02669b79167367bd3c5e8186d46d3f3b6199dc1426729a6057ed12f701f5b31f274e30036b63b6bc13e862433
SSDEEP

6144:BCSFUBxLVs+eChIHvkcOpntFx2frJ2rZdWIDSrGqI7gubJIeWr:I8MxLVs+thIHvkcOpntFx2frJ2rZdWIO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fdecfb4064a2e20419bbeb74cabf4dbe_JaffaCakes118

Files

fdecfb4064a2e20419bbeb74cabf4dbe_JaffaCakes118
.dll windows:6 windows x86 arch:x86

fa913cb0c87871fe7f6b073cf28ec9c8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
VirtualProtectEx
CreateRemoteThread
SetUnhandledExceptionFilter
ExitThread
ExitProcess
GetSystemTime
SystemTimeToFileTime
LocalFree
GetSystemDirectoryA
GetVolumeInformationA
GetComputerNameA
CreateFileA
WriteFile
GetThreadId
WaitForMultipleObjects
LocalAlloc
CreateNamedPipeA
ConnectNamedPipe
GetOverlappedResult
ResetEvent
ReadFile
GetCurrentProcessId
GetCurrentThreadId
SetNamedPipeHandleState
SetHandleInformation
CreateNamedPipeW
CreateFileW
PeekNamedPipe
GlobalFree
CreateMutexA
ReleaseMutex
WaitForSingleObject
SetEvent
CreateThread
TerminateThread
MultiByteToWideChar
WideCharToMultiByte
DecodePointer
GetConsoleMode
GetConsoleOutputCP
FlushInstructionCache
VirtualProtect
VirtualQuery
VirtualFree
VirtualAlloc
GetVersionExA
FreeLibrary
ResumeThread
Sleep
Thread32Next
SuspendThread
OpenThread
Thread32First
CreateToolhelp32Snapshot
GetProcAddress
LoadLibraryA
SetLastError
VirtualQueryEx
WriteProcessMemory
VirtualAllocEx
DuplicateHandle
CreateEventA
FlushFileBuffers
HeapSize
SetStdHandle
GetStringTypeW
SetFilePointerEx
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
WriteConsoleW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
LCMapStringW
HeapReAlloc
GetFileType
GetStdHandle
HeapFree
HeapAlloc
GetModuleFileNameW
GetModuleHandleExW
RaiseException
EncodePointer
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLastError
OpenProcess
CloseHandle
GetCurrentProcess
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind

user32

GetUserObjectInformationA
GetThreadDesktop
GetProcessWindowStation

advapi32

LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
CryptDuplicateKey
CryptSetKeyParam
OpenThreadToken
LookupPrivilegeValueW
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
SetEntriesInAclW
AllocateAndInitializeSid
CryptImportKey
CryptReleaseContext
CryptAcquireContextA
CryptEncrypt
CryptGenRandom
CryptDestroyKey
CryptDecrypt
ImpersonateLoggedOnUser

ole32

CoCreateGuid

wininet

HttpOpenRequestW
InternetCloseHandle
HttpSendRequestW
HttpQueryInfoW
InternetReadFile
InternetOpenW
InternetCrackUrlW
InternetConnectW
InternetSetOptionW

ws2_32

send
WSAStartup
recv
htons
htonl
WSADuplicateSocketA
WSAGetLastError
getaddrinfo
socket
bind
freeaddrinfo
setsockopt
gethostbyname
inet_ntoa
closesocket
inet_addr
listen
accept
select
connect
ntohl

winhttp

WinHttpReceiveResponse
WinHttpQueryOption
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpOpen
WinHttpSetOption
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpenRequest
WinHttpCrackUrl
WinHttpReadData
WinHttpConnect
WinHttpSendRequest

crypt32

CryptImportPublicKeyInfo
CertGetCertificateContextProperty
CryptDecodeObjectEx

Sections

.text
Size: 225KB - Virtual size: 225KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fa913cb0c87871fe7f6b073cf28ec9c8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

wininet

ws2_32

winhttp

crypt32

Sections

.text Size: 225KB - Virtual size: 225KB

.rdata Size: 34KB - Virtual size: 33KB

.data Size: 10KB - Virtual size: 18KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 225KB - Virtual size: 225KB

.rdata
Size: 34KB - Virtual size: 33KB

.data
Size: 10KB - Virtual size: 18KB

.reloc
Size: 7KB - Virtual size: 6KB