1b184cad268712b8b24e8ced2ef6b6fc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

1b184cad268712b8b24e8ced2ef6b6fc_JaffaCakes118
Size

100KB
MD5

1b184cad268712b8b24e8ced2ef6b6fc
SHA1

69648c9092461b6f1990bdc0d69910639b6e2acf
SHA256

104ef5c3ed5417451c5d8c7d0f4d36656f3ac83548befecaf9cd88c7e5b93e31
SHA512

19cf71c5be5dba1e44845be3636a43f9d9af8563080c5361a70ca496cda420adf584e5aadeb763717be55e76be2a350c6de288c7a6593f6a541008b55200b739
SSDEEP

1536:3oMM6i+jED0Gs60BIZGOMyORKG2aY3SEgXRGXenckFDN3K8Fc0bBI7wogVlI615:3oN+Ws6YI5MyO83SHncODldBI7wJlI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b184cad268712b8b24e8ced2ef6b6fc_JaffaCakes118

Files

1b184cad268712b8b24e8ced2ef6b6fc_JaffaCakes118
.dll windows:4 windows x86 arch:x86

d301ac8b61b046cfeb01a7b526ae8963

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

AccessCheck
BuildImpersonateExplicitAccessWithNameA
LookupPrivilegeDisplayNameW
OpenThreadToken
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegOpenKeyW
RegQueryValueExW

gdi32

ExtEscape
AddFontResourceExA

kernel32

CloseHandle
CreateThread
EnterCriticalSection
GetConsoleWindow
GetCurrentThread
GetLastError
GetStartupInfoA
HeapFree
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
lstrcpyW
lstrlenW
VirtualAlloc
LoadResource
FindResourceA
CreateFileMappingW
FindClose
FindFirstFileW
GetCurrentThreadId
LocalAlloc
LocalFree
MapViewOfFile
UnmapViewOfFile
CompareStringW
CompareStringA
GetLocaleInfoW
GetSystemInfo
VirtualProtect
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
HeapSize
LoadLibraryA
VirtualQuery
InterlockedExchange
SetEnvironmentVariableA
RtlUnwind
GetCommandLineA
GetVersionExA
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
WriteFile
FatalAppExitA
GetACP
GetOEMCP
GetCPInfo
HeapReAlloc
IsBadWritePtr
InitializeCriticalSection

ole32

HDC_UserUnmarshal
CoTaskMemAlloc
HGLOBAL_UserMarshal

rpcrt4

MesDecodeBufferHandleCreate
RpcImpersonateClient
RpcRevertToSelf
RpcServerInqDefaultPrincNameW
RpcServerRegisterAuthInfoW
RpcServerRegisterIfEx
RpcBindingFree

user32

GetWindowLongW
GetWindowLongA
GetDlgItem
GetWindowThreadProcessId
DefWindowProcW
CallWindowProcW
DlgDirSelectComboBoxExW
LoadStringW
MessageBoxW
PeekMessageW
SendMessageW
SendNotifyMessageW
SetWindowLongW
DispatchMessageW
SetWindowTextW

Exports

Exports

XCDGVWTMJDT

Sections

.text
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d301ac8b61b046cfeb01a7b526ae8963

Headers

File Characteristics

Imports

advapi32

gdi32

kernel32

ole32

rpcrt4

user32

Exports

Exports

Sections

.text Size: 55KB - Virtual size: 54KB

.rdata Size: 13KB - Virtual size: 12KB

.data Size: 27KB - Virtual size: 27KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 55KB - Virtual size: 54KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 27KB - Virtual size: 27KB

.reloc
Size: 4KB - Virtual size: 3KB