6f8fd8507311a5d70eaf8bf1e9c710e7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6f8fd8507311a5d70eaf8bf1e9c710e7_JaffaCakes118
Size

2.2MB
MD5

6f8fd8507311a5d70eaf8bf1e9c710e7
SHA1

7b6902df4502ed06b5e412a7460119d50f4d8fbd
SHA256

32093e45459d57bd02f320598dd2a2dc0d17cd5c954fd09e653b60fd36940289
SHA512

1e41ff5cc429562088a6e05cef2907fa1253faa96aaf20f330f0d333d56cf19e0ad53ce21c43054ae16d2a8fe67bac5e7a003c7d2ddbb80c92575a4fe5546042
SSDEEP

49152:912PckNK8AXhEDIoBLL/Brdn3UhipWO2uTvf7rAdkGOUYC78:D2bu6BLLJJlP28WY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6f8fd8507311a5d70eaf8bf1e9c710e7_JaffaCakes118

Files

6f8fd8507311a5d70eaf8bf1e9c710e7_JaffaCakes118
.dll windows:6 windows x86 arch:x86

475ec2eb9680ddd37274b98b2079a8cb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Viktor\Desktop\Neon\Release\Example.pdb

Imports

kernel32

GetTempPathW
FindClose
MultiByteToWideChar
Sleep
GetFileAttributesA
WritePrivateProfileStringA
CreateThread
HeapAlloc
ExitProcess
GetModuleHandleW
GetPrivateProfileStringA
GetTickCount
IsDebuggerPresent
GetFullPathNameW
GetCurrentDirectoryW
SetStdHandle
HeapSize
HeapReAlloc
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
CreateDirectoryW
GetTimeZoneInformation
GetFileAttributesExW
CreateProcessW
lstrlenW
CloseHandle
GetExitCodeProcess
WaitForSingleObject
GetFileSizeEx
GetConsoleCP
FlushFileBuffers
GetCurrentProcess
HeapFree
VirtualProtect
FindNextFileA
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
WriteFile
GetProcAddress
ReadConsoleW
GetConsoleMode
OutputDebugStringW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
CreateFileW
SetFilePointerEx
FreeLibraryAndExitThread
ExitThread
DeleteFileW
WriteConsoleW
GetModuleHandleExW
GetModuleFileNameW
GetModuleHandleA
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalUnlock
LoadLibraryExW
RaiseException
InterlockedFlushSList
RtlUnwind
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
FormatMessageA
VerifyVersionInfoA
LoadLibraryA
GetSystemDirectoryA
VerSetConditionMask
SleepEx
InitializeCriticalSectionEx
GetTickCount64
FreeLibrary
GetCPInfo
SetEndOfFile
GetStringTypeW
GetLocaleInfoW
LCMapStringW
GlobalLock
GlobalFree
FindFirstFileA
CompareStringW
GlobalAlloc
DecodePointer
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
SetLastError
WideCharToMultiByte
GetLastError
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
InitializeSListHead
UnhandledExceptionFilter

user32

SetClipboardData
GetClipboardData
EmptyClipboard
SetCursor
OpenClipboard
GetCursorPos
SetCursorPos
IsChild
ClientToScreen
ScreenToClient
LoadCursorA
CloseClipboard
GetForegroundWindow
CallWindowProcW
GetAsyncKeyState
GetKeyState
GetClientRect

gdi32

AddFontResourceW

advapi32

CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

xinput1_3

ord4
ord2

ws2_32

closesocket
bind
send
recv
WSASetLastError
select
__WSAFDIsSet
socket
WSAGetLastError
WSACleanup
WSAStartup
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSAIoctl
getaddrinfo
freeaddrinfo
listen
recvfrom
sendto
ioctlsocket
gethostname
htonl
ntohl
connect
accept

crypt32

CertFreeCertificateContext

wldap32

ord46
ord143
ord211
ord30
ord200
ord301
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord79
ord33
ord35

d3dx9_43

D3DXCreateTextureFromFileA
D3DXAssembleShader
D3DXCreateTextureFromFileInMemoryEx
D3DXCreateFontA
D3DXCreateSprite
D3DXCreateTextureFromFileInMemory

wininet

InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetReadFile

urlmon

URLDownloadToFileW

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 535KB - Virtual size: 534KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 591KB - Virtual size: 667KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

475ec2eb9680ddd37274b98b2079a8cb

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

imm32

xinput1_3

ws2_32

crypt32

wldap32

d3dx9_43

wininet

urlmon

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 535KB - Virtual size: 534KB

.data Size: 591KB - Virtual size: 667KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 68KB - Virtual size: 67KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 535KB - Virtual size: 534KB

.data
Size: 591KB - Virtual size: 667KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 68KB - Virtual size: 67KB