1818b2416448e28432c6bd8de41ba855_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

1818b2416448e28432c6bd8de41ba855_JaffaCakes118
Size

56KB
MD5

1818b2416448e28432c6bd8de41ba855
SHA1

d57edf4c24360e2a33fd9b1b1d1807c198d25811
SHA256

d96c6ae1df7885c3ce4589eb541b6f09e95dec9f60b0d011563b123d401a70a3
SHA512

904bee6c863fb94529b7baf59d55627ca4a2dd15e3736d0b6116dbe9e6ca0e2a93a53cc5cc7d020b59e08622b8764ba3662826f79c4079457e32d59802ec6d00
SSDEEP

1536:6MI++Yx7ffHblObdsauMwekypFILsA27AHc6Q7:6MR7nHblOBRuMGiOLsA26HG

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/hijack_hl2.dll
unpack001/hijack_hl2.exe
unpack001/hl2.exe

Files

1818b2416448e28432c6bd8de41ba855_JaffaCakes118
.zip
COPYING
hijack_hl2.dll
.dll windows:4 windows x86 arch:x86

d734858bc7f173230b741ba2e6dce456

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

AddAtomA
CopyFileA
FindAtomA
FlushInstructionCache
GetAtomNameA
GetCurrentProcess
GetModuleHandleA
GetProcAddress
VirtualProtect

msvcrt

__dllonexit
_errno
_strlwr
abort
fflush
free
malloc
strcmp
strcpy
strrchr
strstr

user32

MessageBoxA

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 144B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
hijack_hl2.exe
.exe windows:4 windows x86 arch:x86

d3c227217fbcc6303c3bd4986812c853

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

AdjustTokenPrivileges
GetTokenInformation
LookupPrivilegeValueA
OpenProcessToken
SetEntriesInAclA
SetSecurityInfo

kernel32

AddAtomA
CloseHandle
CreateProcessA
CreateRemoteThread
DuplicateHandle
ExitProcess
FindAtomA
GetAtomNameA
GetCommandLineA
GetCurrentProcess
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
LocalFree
OpenProcess
SetUnhandledExceptionFilter
VirtualAllocEx
VirtualFreeEx
WaitForSingleObject
WriteProcessMemory
lstrlenA
lstrlenW

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_fileno
_iob
_onexit
_setmode
abort
atexit
free
malloc
signal

user32

MessageBoxA
wsprintfW

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 112B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
hijack_hl2_src.zip
.zip
hijack_dll.c
hijack_dll.dev
hijack_exe.c
hijack_exe.dev
hl2.exe
.exe windows:4 windows x86 arch:x86

3f451688b654bcd8e1315193df963088

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA

kernel32

GetStdHandle
CloseHandle
GetProcAddress
LocalFree
FormatMessageA
GetLastError
LoadLibraryA
GetModuleFileNameA
MultiByteToWideChar
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
SetEnvironmentVariableW
TerminateProcess
GetCurrentProcess
SetEnvironmentVariableA
HeapAlloc
WideCharToMultiByte
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
HeapReAlloc
VirtualAlloc
IsBadWritePtr
SetFilePointer
GetCPInfo
CompareStringA
CompareStringW
GetACP
GetOEMCP
SetStdHandle
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
FlushFileBuffers

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
readme.txt

Sharing

General

Malware Config

Signatures

Files

d734858bc7f173230b741ba2e6dce456

Headers

File Characteristics

Imports

kernel32

msvcrt

user32

Sections

.text Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 48B

.bss Size: - Virtual size: 144B

.idata Size: 1024B - Virtual size: 720B

.reloc Size: 512B - Virtual size: 236B

d3c227217fbcc6303c3bd4986812c853

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

user32

Sections

.text Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 112B

.bss Size: - Virtual size: 112B

.idata Size: 1KB - Virtual size: 1KB

3f451688b654bcd8e1315193df963088

Headers

File Characteristics

Imports

user32

kernel32

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 12KB - Virtual size: 15KB

.rsrc Size: 32KB - Virtual size: 29KB

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 48B

.bss
Size: - Virtual size: 144B

.idata
Size: 1024B - Virtual size: 720B

.reloc
Size: 512B - Virtual size: 236B

.text
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 112B

.bss
Size: - Virtual size: 112B

.idata
Size: 1KB - Virtual size: 1KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 12KB - Virtual size: 15KB

.rsrc
Size: 32KB - Virtual size: 29KB

.reloc
Size: 4KB - Virtual size: 1KB