1a4c451fab318cee6c4f8e6027f6cdf7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

1a4c451fab318cee6c4f8e6027f6cdf7_JaffaCakes118
Size

64KB
MD5

1a4c451fab318cee6c4f8e6027f6cdf7
SHA1

d1516af58a89fe8d59e136bb0801d5bc53ea4f88
SHA256

b34de63c516fbfbb1669d95527de8f0d1e0e970d1397c2d329f5dc7135f5bdd7
SHA512

52dba9624aa43f8f47b0d2a5191efb1786fd7129bbf9aded70ba2c6bee66bcfc3bdf960f64f70b1bde43279986e3e758458061d02a600d3a9607c1cc047615c4
SSDEEP

1536:BfHt9IKlLgTETKVS/gl+KRBgeKfhnr0lO7:B2Q/SBg3fhn4l6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a4c451fab318cee6c4f8e6027f6cdf7_JaffaCakes118

Files

1a4c451fab318cee6c4f8e6027f6cdf7_JaffaCakes118
.dll windows:4 windows x86 arch:x86

e63aabf2b8775c41f6585899c06d757a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_adjust_fdiv
_initterm
_onexit
__dllonexit
printf
longjmp
_setjmp3
_itoa
free
memmove
_purecall
strncmp
atoi
strncpy
strcmp
_strcmpi
isdigit
_strdup
sscanf
??2@YAPAXI@Z
??3@YAXPAX@Z
_strlwr
memset
memcpy
memcmp
strchr
strncat
__CxxFrameHandler
strstr
sprintf
strlen
malloc
strcpy
strcat
??1type_info@@UAE@XZ
_CxxThrowException
strspn
strcspn
tolower
isxdigit
isupper
isspace
ispunct
isprint
islower
isgraph
iscntrl
isalpha
isalnum

advapi32

CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CryptDestroyKey
CryptDecrypt
CryptEncrypt
CryptImportKey
CryptGetUserKey
CryptDeriveKey
CryptGenKey

kernel32

GetComputerNameA
UnmapViewOfFile
lstrcpynA
CreateFileMappingA
MapViewOfFile
lstrcmpiA
GetWindowsDirectoryA
CreateFileA
GetFileSize
ReadFile
SetFilePointer
CreateMutexA
WaitForSingleObject
ReleaseMutex
FlushViewOfFile
Sleep
GetCurrentProcess
VirtualProtect
FlushInstructionCache
LocalFree
GetVersionExA
GetVolumeInformationA
FreeLibrary
VirtualQuery
SetLastError
LeaveCriticalSection
EnterCriticalSection
GetLastError
GetTickCount
TlsSetValue
TlsGetValue
lstrlenA
GetCurrentProcessId
TlsAlloc
GetProcAddress
LoadLibraryA
TlsFree
GetModuleHandleA
GetModuleFileNameA
CreateThread
CreateEventA
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
TerminateThread
WaitForMultipleObjects
SetEvent
lstrcpyA
SetEndOfFile
WriteFile
MultiByteToWideChar

user32

CallNextHookEx
EnumWindows
UpdateWindow
BringWindowToTop
SetForegroundWindow
CharLowerA
FindWindowA
SendMessageA
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowTextA

ws2_32

send
recv
closesocket
WSARecv
connect
WSAGetLastError
ntohs
getpeername
WSASend
inet_ntoa

ole32

CoCreateInstance
OleUninitialize
OleInitialize

wininet

HttpOpenRequestA
InternetCloseHandle
HttpSendRequestA
InternetOpenUrlA
InternetConnectA
HttpQueryInfoA
HttpAddRequestHeadersA
InternetQueryOptionA
InternetOpenA
InternetReadFile

oleaut32

VariantClear
SysAllocString
SysFreeString

Exports

Exports

Fire

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Shared
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e63aabf2b8775c41f6585899c06d757a

Headers

File Characteristics

Imports

msvcrt

advapi32

kernel32

user32

ws2_32

ole32

wininet

oleaut32

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 43KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 3KB - Virtual size: 5KB

.Shared Size: 512B - Virtual size: 8B

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 44KB - Virtual size: 43KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 3KB - Virtual size: 5KB

.Shared
Size: 512B - Virtual size: 8B

.reloc
Size: 5KB - Virtual size: 4KB