4b937f0166e60db09d8ad7cf5ed9495a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4b937f0166e60db09d8ad7cf5ed9495a_JaffaCakes118
Size

117KB
MD5

4b937f0166e60db09d8ad7cf5ed9495a
SHA1

694aba764c7c76fd868b5d5f4f7b32f25fa209d7
SHA256

ffcc29e5f7f231855acca10c38122fe0748d4894cd7d77d6d6b102e39b7bf683
SHA512

dfff3da53aaacb0f915f1cc06a62a66ebe19b2dc5e6c68f105300a1a048fbfc4158115e12ede2cb73f36ee7836a8bef93817ae1e43af2429aeee4becb368ceb0
SSDEEP

3072:MkOTfCv+NBD0eaS08ZiG+Om19SYAOqg8DJKxkcbCPs8:MHKG4eaFsm19SYA3tKx1bCp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4b937f0166e60db09d8ad7cf5ed9495a_JaffaCakes118

Files

4b937f0166e60db09d8ad7cf5ed9495a_JaffaCakes118
.dll windows:6 windows x86 arch:x86

99cbf335e1bc0a90e2785c220e9aa25d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
Sleep
CreateThread
GetProcAddress
GetModuleFileNameA
ExitProcess
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
DeleteCriticalSection

user32

wsprintfW
MessageBoxA
CallWindowProcA
FindWindowA
SetWindowLongA
GetAsyncKeyState

msvcp140

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z

vcruntime140

_CxxThrowException
__CxxFrameHandler3
__std_exception_destroy
memmove
memcpy
memcmp
__std_exception_copy
_purecall
strstr
__current_exception
__std_type_info_destroy_list
_except_handler4_common
memset
__current_exception_context

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
exit
terminate
_invalid_parameter_noinfo_noreturn
_configure_narrow_argv
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s
fclose
__stdio_common_vfprintf_s
__stdio_common_vsnprintf_s
fopen_s

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc

api-ms-win-crt-convert-l1-1-0

mbstowcs

api-ms-win-crt-string-l1-1-0

strcat_s
strcpy_s

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-time-l1-1-0

_localtime64_s
_time64

api-ms-win-crt-math-l1-1-0

_libm_sse2_atan_precise
_libm_sse2_acos_precise
_libm_sse2_cos_precise
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
_CIatan2
ceil

Sections

.text
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

99cbf335e1bc0a90e2785c220e9aa25d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 83KB - Virtual size: 83KB

.rdata Size: 22KB - Virtual size: 22KB

.data Size: 2KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 83KB - Virtual size: 83KB

.rdata
Size: 22KB - Virtual size: 22KB

.data
Size: 2KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 8KB - Virtual size: 7KB