1abf790f883c8acfdd1ae39bfd72ca4f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

1abf790f883c8acfdd1ae39bfd72ca4f_JaffaCakes118
Size

280KB
MD5

1abf790f883c8acfdd1ae39bfd72ca4f
SHA1

fd5e478907c6b9689390a3c8e0445981199202a9
SHA256

d533ba3229d42b93eaf7d23b251498176900ebe870447f5eafea9083e7ab5aab
SHA512

2fb814517d19a6a757c07591924918f6b6bdca8240283f8813ad7e1d8154fdee1f9737c3a5afd695d162eee2f08f94bc9458aedc02ddeff0d2c53a770a588aac
SSDEEP

6144:4ALwhfYUBMdruO9s0Md5/pXKHtN+aGUgmAOYL59:4AL0fYUYYyxGGu59

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1abf790f883c8acfdd1ae39bfd72ca4f_JaffaCakes118

Files

1abf790f883c8acfdd1ae39bfd72ca4f_JaffaCakes118
.dll windows:4 windows x86 arch:x86

bbf7da20918df9f2ad5508e4df08a382

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Documents and Settings\admin\Desktop\hl2 pub\Hl2\Release\PULICA.pdb

Imports

kernel32

GetProcAddress
GetModuleHandleA
VirtualProtect
Sleep
CreateThread
IsBadReadPtr
GetModuleFileNameA
WritePrivateProfileStringA
ExitProcess
GetPrivateProfileIntA
VirtualQuery
HeapAlloc
GetProcessHeap
CloseHandle
GetLocaleInfoW
FlushFileBuffers
GetSystemInfo
VirtualAlloc
SetStdHandle
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
RtlUnwind
GetLocalTime
GetCurrentThreadId
GetCommandLineA
GetVersionExA
TlsAlloc
SetLastError
GetLastError
TlsFree
TlsSetValue
TlsGetValue
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteFile
LeaveCriticalSection
EnterCriticalSection
GetACP
GetOEMCP
GetCPInfo
SetUnhandledExceptionFilter
IsBadWritePtr
IsBadCodePtr
SetFilePointer
RaiseException
InitializeCriticalSection
InterlockedExchange
LoadLibraryA
LCMapStringA
MultiByteToWideChar
LCMapStringW
ReadFile

user32

FindWindowA
wsprintfA
GetAsyncKeyState
GetWindowTextA

shell32

ShellExecuteA

vstdlib

RandomFloat
Q_strncpy
Q_snprintf
KeyValuesSystem
Q_strnicmp
RandomSeed

tier0

?GetSubNode@CVProfNode@@QAEPAV1@PBDH0H@Z
?EnterScope@CVProfNode@@QAEXXZ
?ExitScope@CVProfNode@@QAE_NXZ
g_VProfCurrentProfile
g_pMemAlloc
GetCPUInformation
Msg
Error

Sections

.text
Size: 200KB - Virtual size: 196KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bbf7da20918df9f2ad5508e4df08a382

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

vstdlib

tier0

Sections

.text Size: 200KB - Virtual size: 196KB

.rdata Size: 44KB - Virtual size: 40KB

.data Size: 12KB - Virtual size: 215KB

.reloc Size: 20KB - Virtual size: 18KB

.text
Size: 200KB - Virtual size: 196KB

.rdata
Size: 44KB - Virtual size: 40KB

.data
Size: 12KB - Virtual size: 215KB

.reloc
Size: 20KB - Virtual size: 18KB