059485253ca53b84964ee22642c1bd4a_JaffaCakes118

General

Target

059485253ca53b84964ee22642c1bd4a_JaffaCakes118
Size

27KB
MD5

059485253ca53b84964ee22642c1bd4a
SHA1

a5c15088e822d79b9ae3b04406668e891dadb7fe
SHA256

9843d050b46f457190ca76f9f694bec5b10b961c95a10ba67948ef857634d7b3
SHA512

5d28e6a265e09763c0c53340917547a5c87dadee250a9d15503d73a9d0e03b3db48c702f4f05b932fd77d02e9a0ff1a61cc42e4aacb3845d8cf670c249610335
SSDEEP

768:ZGd+Jxcc6YNnGupa0SER2Sb9D+dPI2JSDRWZ9v:rJxcc6cGipEQ+VIHlMv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
059485253ca53b84964ee22642c1bd4a_JaffaCakes118

Files

059485253ca53b84964ee22642c1bd4a_JaffaCakes118
.dll windows:4 windows x86 arch:x86

264fcb89918add98d59d40256a57d485

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualProtectEx
TerminateProcess
TerminateThread
IsBadReadPtr
GetPrivateProfileStringA
RaiseException
WideCharToMultiByte
GetModuleHandleA
ReadProcessMemory
SetThreadContext
OpenThread
SetUnhandledExceptionFilter
GetCurrentThread
Process32Next
InitializeCriticalSection
CreateToolhelp32Snapshot
GetModuleFileNameA
GetCurrentThreadId
GetCurrentProcess
WriteProcessMemory
Sleep
CreateThread
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
GetProcAddress
GetCurrentProcessId
CreateMutexA
Process32First
GetLastError

user32

GetWindowTextA
GetForegroundWindow
FindWindowA
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
GetWindowThreadProcessId

ws2_32

WSASetLastError

wininet

InternetOpenA
InternetCloseHandle
InternetReadFile
InternetOpenUrlA

msvcrt

sscanf
_strlwr
_stricmp
_strupr
_adjust_fdiv
malloc
_initterm
free
strrchr
wcslen
strcmp
fopen
strcat
sprintf
strcpy
memcpy
atoi
strchr
memset
??2@YAPAXI@Z
strncpy
??3@YAXPAX@Z
_strnicmp
strlen
strstr
fclose
fread

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdata
Size: 512B - Virtual size: 153B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

264fcb89918add98d59d40256a57d485

Headers

File Characteristics

Imports

kernel32

user32

ws2_32

wininet

msvcrt

Sections

.text Size: 18KB - Virtual size: 18KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 4KB

sdata Size: 512B - Virtual size: 153B

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 18KB - Virtual size: 18KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 4KB

sdata
Size: 512B - Virtual size: 153B

.reloc
Size: 3KB - Virtual size: 2KB