21733a2858bbf0ef3ecdb874e05b17dc_JaffaCakes118

General

Target

21733a2858bbf0ef3ecdb874e05b17dc_JaffaCakes118
Size

20KB
MD5

21733a2858bbf0ef3ecdb874e05b17dc
SHA1

e153034ba17b712cd20d954c72e4edba53abebf3
SHA256

c9a48630788e01af63ab9d04eeb8819f3188b47e941017977e5bd0e56ebba498
SHA512

1e7bda9b5619226ec08350e6208d3b36d4283a8921af76b97b6f1ab8028354c116b2ffa12e777365fc4dedc890fe638f7110ab2aa718d514a67db9dd4bc041a7
SSDEEP

384:fiGN3oDGP0qDLMj+6LZp9e/FudZpKIqJ:6GN3qiLQTIFkZpKIa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
21733a2858bbf0ef3ecdb874e05b17dc_JaffaCakes118

Files

21733a2858bbf0ef3ecdb874e05b17dc_JaffaCakes118
.dll windows:4 windows x86 arch:x86

c71080a61155965e2d4d7a5a243276c4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalLock
GlobalAlloc
GetCommandLineA
Sleep
GetCurrentProcessId
ReadProcessMemory
GetCurrentProcess
IsBadReadPtr
GetProcAddress
GetModuleHandleA
WriteProcessMemory
TerminateThread
GlobalUnlock
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentThreadId
CreateRemoteThread
GlobalFree
VirtualAllocEx
OpenProcess
DeleteFileA
CreateFileA
WriteFile
GetFileSize
ReadFile
VirtualProtectEx
SetThreadPriority
VirtualAlloc
VirtualFree
WinExec
GetTempPathA
GetModuleFileNameA
OpenEventA
CreateEventA
CreateThread
VirtualFreeEx
CloseHandle

user32

GetInputState
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
wsprintfA
GetWindowThreadProcessId
FindWindowA
PostThreadMessageA
GetWindowTextA
GetMessageA

wininet

InternetCloseHandle
InternetOpenA
InternetOpenUrlA

urlmon

URLDownloadToFileA

advapi32

RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c71080a61155965e2d4d7a5a243276c4

Headers

File Characteristics

Imports

kernel32

user32

wininet

urlmon

advapi32

Sections

.text Size: 17KB - Virtual size: 16KB

sdata Size: 512B - Virtual size: 512B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 17KB - Virtual size: 16KB

sdata
Size: 512B - Virtual size: 512B

.reloc
Size: 1KB - Virtual size: 1KB