604bbf50778c5ddc4a8ff974d12c9296_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

604bbf50778c5ddc4a8ff974d12c9296_JaffaCakes118
Size

254KB
MD5

604bbf50778c5ddc4a8ff974d12c9296
SHA1

e8043e4a32fc3a3da97db2c98a004880f574030b
SHA256

9d66a23b87e930269204272a71063d5e616a7b40cd6e9e08775c26c23a135a2b
SHA512

f71d456020063b1dbf8e06bad519f287ec9aa569c2aa2a2318615994fe346b3edbce8117e72b473fbb4c7f010814dd03902cedce7aabf3ff447d980747e22a62
SSDEEP

3072:2SfGIqV98OeZybMPgHN5rHy0mmaK2lJ1xJuY+2vOTW0L8zNO3I52Qm:2SHqV98QbIvnlJ1NKW0LYsom

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
604bbf50778c5ddc4a8ff974d12c9296_JaffaCakes118

Files

604bbf50778c5ddc4a8ff974d12c9296_JaffaCakes118
.dll windows:5 windows x86 arch:x86

bf91dbe4d25415427e538ad4fc8ae3ab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
LoadLibraryW
GetProcAddress
ExpandEnvironmentStringsW
SetErrorMode
FreeLibrary
VirtualFree
GetModuleHandleW
GetModuleFileNameW
GetComputerNameW
GetCurrentProcessId
GetACP
GetCurrentProcess
DeleteFileW
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
SetEnvironmentVariableW
Sleep
SetCurrentDirectoryA
MoveFileExW
CreateThread
GetProcessHeap
SetEndOfFile
CreateFileA
GetLocaleInfoW
CreateFileW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
HeapAlloc
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapCreate
HeapDestroy
VirtualAlloc
HeapReAlloc
CloseHandle
WriteFile
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
HeapSize
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
FlushFileBuffers

advapi32

RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW

shell32

SHGetFolderPathW

ws2_32

recv
send
getaddrinfo
socket
__WSAFDIsSet
freeaddrinfo
setsockopt
shutdown
closesocket
WSAStartup
select
connect

Exports

Exports

IsValidLinkInfo

Sections

.text
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bf91dbe4d25415427e538ad4fc8ae3ab

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

ws2_32

Exports

Exports

Sections

.text Size: 208KB - Virtual size: 208KB

.rdata Size: 26KB - Virtual size: 26KB

.data Size: 8KB - Virtual size: 16KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 208KB - Virtual size: 208KB

.rdata
Size: 26KB - Virtual size: 26KB

.data
Size: 8KB - Virtual size: 16KB

.reloc
Size: 10KB - Virtual size: 9KB