0643b219d51e52c41a1c5d110e5ba701_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

0643b219d51e52c41a1c5d110e5ba701_JaffaCakes118
Size

18KB
MD5

0643b219d51e52c41a1c5d110e5ba701
SHA1

961e394a26eb3a07cd13303d7a41850d111afebd
SHA256

e19fbfd05141b2bd0e7309fee76bbb8fac8f9be192ae997e488f337ad666897c
SHA512

9a008ac6a3dae3759a781740c2e0e6d62582d75a7987453b96b9cad213b3345866e4debaed8226ca3b5ec090f9b407f5b5392adbd6e365b017d77c230caefb06
SSDEEP

192:o1/0Usez9D8lDCM+gZdirL14AAD99hxLNklNE3PG2A7IH1QG0byhunfLjOujtmPN:k/keBSZY+RJzA0rgfLKYw+MVo9g2F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0643b219d51e52c41a1c5d110e5ba701_JaffaCakes118

Files

0643b219d51e52c41a1c5d110e5ba701_JaffaCakes118
.dll windows:4 windows x86 arch:x86

5b76d0202066a69910c88f2f92193ce4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCommandLineA
GetCurrentProcessId
VirtualQuery
Sleep
DeviceIoControl
GetTickCount
GetSystemDirectoryA
GetModuleHandleA
GlobalAlloc
GlobalFree
GetProcAddress
LoadLibraryW
ExpandEnvironmentStringsW
GetLastError
FormatMessageA
CreateFileA
SetFilePointer
ReadFile
CloseHandle
GetModuleFileNameA
GetFileSize

user32

GetForegroundWindow
GetClassNameA
CallWindowProcA
GetKeyState
FindWindowA
GetWindowThreadProcessId
SetWindowLongA
wsprintfA

advapi32

CreateServiceA
OpenServiceA
OpenSCManagerA
StartServiceA
QueryServiceStatus
ControlService
CloseServiceHandle

msvcrt

??3@YAXPAX@Z
__CxxFrameHandler
strstr
sprintf
memmove
strrchr
__dllonexit
_onexit
_initterm
_adjust_fdiv
_except_handler3
malloc
strncpy
free
_strcmpi
_beginthread
_stricmp

msvcp60

?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Xran@std@@YAXXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?_Xlen@std@@YAXXZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB

ws2_32

WSCGetProviderPath
WSCEnumProtocols

wininet

InternetCloseHandle
InternetOpenUrlA
InternetOpenA

Exports

Exports

WSPStartup

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5b76d0202066a69910c88f2f92193ce4

Headers

File Characteristics

Imports

kernel32

user32

advapi32

msvcrt

msvcp60

ws2_32

wininet

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 11KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 936B

.reloc Size: 1024B - Virtual size: 1000B

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 936B

.reloc
Size: 1024B - Virtual size: 1000B