0a69b20f1b8c5f9fd2bdeb25bc3e1b87_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

0a69b20f1b8c5f9fd2bdeb25bc3e1b87_JaffaCakes118
Size

164KB
MD5

0a69b20f1b8c5f9fd2bdeb25bc3e1b87
SHA1

1c5504b39e036928d0d91e51d5aff03f092c2c33
SHA256

42226d04670fe594c530a2124ab8843c22a03ab76df61eb7492e2e355d7c9051
SHA512

b198125a8b1be12199c4a4c15b21d15d546394c362a51e34dbb5b29010e655cf197dfb47c37d590545c866cb05c15527e540b4af019ce893e5eda75d64be0da3
SSDEEP

3072:s2ujDqOGWfePST4cBz9cMSH2H8p1CMMqqDLy/G+y:s28Y2T4hWH0QqqDLuG9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a69b20f1b8c5f9fd2bdeb25bc3e1b87_JaffaCakes118

Files

0a69b20f1b8c5f9fd2bdeb25bc3e1b87_JaffaCakes118
.dll windows:4 windows x86 arch:x86

10aca761f92181952653511fd51c4f9d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
GetTempFileNameA
GetTempPathA
GetCurrentProcessId
FreeLibrary
LoadResource
GlobalAlloc
GlobalUnlock
FindResourceA
CloseHandle
GetProcAddress
LoadLibraryA
lstrcpyA
UnmapViewOfFile
lstrcatA
CreateFileA
LockResource
GlobalFree
GlobalLock
SetFilePointer
InterlockedCompareExchange
SizeofResource
FreeResource
DeleteFileA
LocalReAlloc
LocalSize
GetTickCount
FormatMessageW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
lstrlenW
LocalAlloc
LocalFree
GetFileAttributesW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
GetModuleFileNameW
InterlockedExchange
GetCommandLineA
ReadFile
VirtualProtect

user32

CharNextW
GetDlgItem
SendMessageW
EnableWindow
GetParent
UpdateWindow
InvalidateRect
SetWindowTextW
wsprintfA
LoadStringW
GetFocus
IsWindowEnabled
CharUpperW
DeferWindowPos
MapWindowPoints
GetWindowRect
EndDeferWindowPos
BeginDeferWindowPos
CharUpperBuffW
CharLowerW
IntersectRect
OffsetRect
SetFocus
SetCursor

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

ole32

CoCreateInstance
CoTaskMemFree
ReleaseStgMedium

msvcrt

malloc
_initterm
wcschr
_ftol
rand
memmove
floor
free
__CxxFrameHandler
_except_handler3
memset
memcpy
_adjust_fdiv

Sections

.text
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

10aca761f92181952653511fd51c4f9d

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

msvcrt

Sections

.text Size: 75KB - Virtual size: 75KB

.rdata Size: 35KB - Virtual size: 35KB

.data Size: 16KB - Virtual size: 57KB

.rsrc Size: 33KB - Virtual size: 33KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 75KB - Virtual size: 75KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 16KB - Virtual size: 57KB

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 3KB - Virtual size: 2KB