aa65b706a5ffd4edb0504b1dca4c2dc1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

aa65b706a5ffd4edb0504b1dca4c2dc1_JaffaCakes118
Size

1.7MB
MD5

aa65b706a5ffd4edb0504b1dca4c2dc1
SHA1

4af113d96eb517704f34e0930f05ebff9ed97e87
SHA256

aa6637f1f80d6e1b6ea17d4cb2ba6bac95337cebb37a6ad4bc90f784e4d0c6b0
SHA512

3e4ae87c0e5028177d0681b6a6cc3697f6ffb1720123443e14b9748c2b1d00d0c815d92d14ee84ff763e0395fda3d1abb3bcc12125090ccb5cc460d72a692491
SSDEEP

49152:A8cbjcqGOmcTT85KuSltNz8KR4RvUL78PKJldQTALayh:A8kjc5lMFdlG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa65b706a5ffd4edb0504b1dca4c2dc1_JaffaCakes118

Files

aa65b706a5ffd4edb0504b1dca4c2dc1_JaffaCakes118
.dll windows:6 windows x64 arch:x64

d9eee8ccf2aa3685643a617bf470ec03

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

ExitProcess
GetCurrentProcessId
GetProcessHeap
GlobalMemoryStatusEx
FreeLibrary
VirtualQueryEx
SetEndOfFile
WriteConsoleW
HeapSize
FreeEnvironmentStringsW
Beep
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
ReadConsoleW
ReadFile
SetStdHandle
HeapAlloc
CreateThread
GetSystemInfo
CloseHandle
Process32Next
GlobalAlloc
GetLastError
Sleep
CreateToolhelp32Snapshot
OpenProcess
GetModuleHandleA
GetVolumeInformationA
lstrlenW
GetCurrentProcess
HeapFree
GetEnvironmentStringsW
Process32First
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
GetStdHandle
SetFilePointerEx
GetFileSizeEx
GetModuleFileNameW
GetModuleHandleExW
RtlUnwind
GetFileType
CreateFileW
LoadLibraryExW
InterlockedFlushSList
RaiseException
RtlPcToFileHeader
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlUnwindEx

user32

MapVirtualKeyW
GetWindowRect
GetDC
GetDesktopWindow
GetKeyNameTextW
GetMessageA
wsprintfW
mouse_event
SetLayeredWindowAttributes
DefWindowProcA
GetForegroundWindow
GetAsyncKeyState
ShowWindow
RegisterClassExW
CreateWindowExW
FillRect
SetWindowPos

gdi32

CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
CreateSolidBrush
BitBlt

advapi32

CryptAcquireContextA
RegCloseKey
RegOpenKeyA
RegQueryValueExA
CryptCreateHash
CryptHashData
CryptGetHashParam

gdiplus

GdipCreatePen1
GdipSetStringFormatAlign
GdipDeleteGraphics
GdipFillRectangleI
GdipCloneBrush
GdipCreateFromHDC
GdipDrawString
GdipFree
GdipGetGenericFontFamilySansSerif
GdipDeletePen
GdipCreateSolidFill
GdipCreateFont
GdipAlloc
GdipDeleteBrush
GdipSetPenColor
GdipCreateFontFamilyFromName
GdipDrawRectangleI
GdipDeleteFontFamily
GdiplusStartup
GdipSetSolidFillColor
GdipDeleteFont
GdipDeleteStringFormat
GdipCreateStringFormat

winmm

timeGetTime

wininet

InternetCloseHandle
InternetReadFile
InternetOpenA
InternetOpenUrlA

Sections

.text
Size: 171KB - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

0
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d9eee8ccf2aa3685643a617bf470ec03

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

gdiplus

winmm

wininet

Sections

.text Size: 171KB - Virtual size: 171KB

.rdata Size: 97KB - Virtual size: 96KB

.data Size: 4KB - Virtual size: 3.3MB

.pdata Size: 9KB - Virtual size: 8KB

0 Size: 1.5MB - Virtual size: 1.5MB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 171KB - Virtual size: 171KB

.rdata
Size: 97KB - Virtual size: 96KB

.data
Size: 4KB - Virtual size: 3.3MB

.pdata
Size: 9KB - Virtual size: 8KB

0
Size: 1.5MB - Virtual size: 1.5MB

.reloc
Size: 3KB - Virtual size: 3KB