10524ffaef0421d328498285f2651f4c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

10524ffaef0421d328498285f2651f4c_JaffaCakes118
Size

121KB
MD5

10524ffaef0421d328498285f2651f4c
SHA1

a48c3d5e4a3ef6df10af5c8e51932b72f95ca772
SHA256

2d8dcfc3dd1f5b75bee361fa4e4b4317e76121b6eef9b8e18d1cfc71f199203b
SHA512

f4c10bebf27a63912cb721435a7500e70ee744392d9e2f09f8ff7c7417285afd9c6e945a12634fbeebfcf9fcf08cd68828ce2d172de6cb5f78c0ef75e7e0e0c5
SSDEEP

3072:AKXGgb7muzAWwfoWfzu/HRtoGWSnDjhiOPm3oV/H:lbbyuzAWwfVuRt79XhiOB/H

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
10524ffaef0421d328498285f2651f4c_JaffaCakes118

Files

10524ffaef0421d328498285f2651f4c_JaffaCakes118
.dll windows:4 windows x86 arch:x86

5fcd34819f056f816ebb9e28a4b3c00b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DuplicateHandle
GetCurrentProcess
CreatePipe
WriteFile
ReadFile
GlobalSize
CreateProcessA
TerminateProcess
GetSystemDirectoryA
TerminateThread
DeleteFileA
lstrcpynA
CreateFileA
lstrlenA
lstrcmpA
GetExitCodeThread
CloseHandle
Sleep
GetProcessHeap
HeapAlloc
GetCurrentProcessId
CreateThread
SetEvent
WaitForSingleObject
OpenEventA
HeapReAlloc
HeapFree
SetFilePointer
TlsGetValue
MultiByteToWideChar
SetStdHandle
InterlockedIncrement
InterlockedDecrement
LCMapStringW
LCMapStringA
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
CompareStringA
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
RtlUnwind
GetLastError
GetCommandLineA
GetVersion
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
IsBadReadPtr
IsBadCodePtr
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleHandleA
ExitProcess
GetFileAttributesA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
VirtualFree
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
GetProcAddress
FlushFileBuffers
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter

user32

GetActiveWindow
ReleaseDC
GetWindowRect
GetDC
GetDesktopWindow
wsprintfA
MessageBoxA

gdi32

CreateCompatibleBitmap
DeleteObject
CreateCompatibleDC
BitBlt
GetObjectA
GetDIBits
SelectObject

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA

ws2_32

getsockname
listen
accept
gethostbyname
htons
socket
connect
__WSAFDIsSet
getsockopt
bind
ntohs
select
recv
send
WSAStartup
WSACleanup
inet_addr
closesocket
setsockopt

Exports

Exports

dwInjectionThreadId

Sections

.text
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

InjShare
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5fcd34819f056f816ebb9e28a4b3c00b

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ws2_32

Exports

Exports

Sections

.text Size: 87KB - Virtual size: 87KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 20KB - Virtual size: 25KB

InjShare Size: 512B - Virtual size: 4B

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 87KB - Virtual size: 87KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 20KB - Virtual size: 25KB

InjShare
Size: 512B - Virtual size: 4B

.reloc
Size: 5KB - Virtual size: 5KB