1c20286fdf1ee20c403abc2e4b36786b_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

1c20286fdf1ee20c403abc2e4b36786b_JaffaCakes118
Size

152KB
MD5

1c20286fdf1ee20c403abc2e4b36786b
SHA1

a0a59d822d1519d739195fbc8b60950363fe77ed
SHA256

8f64b67a328ad6fc2b49b0fc3e19ac3eebeb76e96c34850430129b0caa65291b
SHA512

5127245b80614e991ed766874e08ad987daff65128abc445f1c75f3ccaf4a3ffd99c2824420e903f28684ab5ebe807422765135f88421580f17694a309576c9e
SSDEEP

3072:LXwjb05sgme946+WGARVClNzm8jMU3RCGL:Lgjb0Zmp6llVOCg3RbL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c20286fdf1ee20c403abc2e4b36786b_JaffaCakes118

Files

1c20286fdf1ee20c403abc2e4b36786b_JaffaCakes118
.dll windows:4 windows x86 arch:x86

43e32fd7052f718a4053236317a0a678

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
ExitProcess
WriteProcessMemory
GetProcessHeap
LoadLibraryA
ReadProcessMemory
HeapFree
GetModuleFileNameA
UnmapViewOfFile
GlobalAlloc
CloseHandle
EnterCriticalSection
GetCommandLineA
GetModuleHandleA
OpenEventA
CreateEventA
LocalFree
HeapAlloc
WriteFile
GlobalFree
MapViewOfFile
WaitForSingleObject
InterlockedIncrement
InterlockedCompareExchange
GetTickCount
InterlockedDecrement
TerminateProcess
SetLastError
OpenFileMappingA
CopyFileA
CreateFileMappingA
LeaveCriticalSection
GetProcAddress
GetVolumeInformationA
GetLastError
GetCurrentProcess
CreateFileA
GetComputerNameA
CreateMutexW
CreateDirectoryA
CreateProcessA

ole32

OleSetContainedObject
CoInitialize
CoSetProxyBlanket
CoCreateGuid
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
OleCreate

user32

GetClassNameA
TranslateMessage
PostQuitMessage
DefWindowProcA
KillTimer
PeekMessageA
CreateWindowExA
SetWindowLongA
SendMessageA
UnhookWindowsHookEx
SetWindowsHookExA
GetCursorPos
SetTimer
RegisterWindowMessageA
DestroyWindow
ScreenToClient
GetWindowThreadProcessId
GetMessageA
FindWindowA
GetSystemMetrics
GetWindow
GetWindowLongA
ClientToScreen
GetParent
DispatchMessageA

oleaut32

SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen

shlwapi

UrlUnescapeW
StrStrIW

advapi32

DuplicateTokenEx
SetTokenInformation
RegCloseKey
RegQueryValueExA
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
OpenProcessToken
GetUserNameA

shell32

SHGetFolderPathA

Exports

Exports

LibWIdsc

Sections

.text
Size: 120KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

snzpwcr
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

43e32fd7052f718a4053236317a0a678

Headers

File Characteristics

Imports

kernel32

ole32

user32

oleaut32

shlwapi

advapi32

shell32

Exports

Exports

Sections

.text Size: 120KB - Virtual size: 117KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 976B

snzpwcr Size: 4KB - Virtual size: 4B

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 120KB - Virtual size: 117KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 976B

snzpwcr
Size: 4KB - Virtual size: 4B

.reloc
Size: 8KB - Virtual size: 6KB