21948eb9b2147e8afd8459ca025cc8e5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

21948eb9b2147e8afd8459ca025cc8e5_JaffaCakes118
Size

120KB
MD5

21948eb9b2147e8afd8459ca025cc8e5
SHA1

cbf387fc3383de38ef78adb99cd30e3e0aff96a6
SHA256

576b6cb2114c9ede1b1127b2cfb7591fad2362b6f46ed2d4f71a0b90ae6ce6f0
SHA512

55aa48414d7c0c53ab28b86a4b512c326cbf7ca22474b4ff582fa997c02548539a2bb45d044c54ad04924b59466432f5cde93a28b665748c92eb18d073ebaa05
SSDEEP

3072:Ha0GoXlEAQ7Sqne4RsNM/hCKdomjTl0a9f5lr:60GbjXne9whRjN9P

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
21948eb9b2147e8afd8459ca025cc8e5_JaffaCakes118

Files

21948eb9b2147e8afd8459ca025cc8e5_JaffaCakes118
.dll windows:4 windows x86 arch:x86

f4bcde8273754171e396ac6581297442

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateToolhelp32Snapshot
Process32Next
Process32First
Sleep
GetModuleFileNameA
OpenEventA
GetSystemTimeAsFileTime
LoadLibraryA
GetLastError
CreateMutexA
CreateProcessA
DeleteFileA
GetVolumeInformationA
GetLocalTime
MapViewOfFile
OpenFileMappingA
GetWindowsDirectoryA
CreateFileMappingA
GetPrivateProfileSectionA
lstrlenA
OpenProcess
lstrlenW
VirtualAllocEx
WriteProcessMemory
GetModuleHandleA
GetProcAddress
CreateRemoteThread
WaitForSingleObject
VirtualFreeEx
CloseHandle
GetProcessHeap
GetLogicalDrives
UnmapViewOfFile
GetCompressedFileSizeA
OpenMutexA
SetFileAttributesA
SetEndOfFile
CreateFileA
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetLocaleInfoW
ReadFile
SetStdHandle
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
GetFileAttributesA
RaiseException
ExitThread
GetCurrentThreadId
CreateThread
HeapFree
GetCommandLineA
GetVersionExA
HeapAlloc
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetCPInfo
VirtualQuery
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
VirtualProtect
VirtualAlloc
GetSystemInfo
SetUnhandledExceptionFilter
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
HeapReAlloc
HeapSize
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
WriteFile
FlushFileBuffers
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
IsBadReadPtr
IsBadCodePtr

user32

wsprintfW

advapi32

RegCreateKeyA
GetUserNameA
CreateProcessAsUserA
RegCreateKeyExA
RegSetValueExA
RegEnumValueA
RegDeleteValueA
RegOpenKeyA
RegCloseKey
OpenProcessToken
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryInfoKeyA
RegSetKeySecurity
RegQueryValueA
RegQueryValueExA
RegGetKeySecurity

wininet

DeleteUrlCacheEntry
InternetGetConnectedState

urlmon

URLDownloadToFileA

Exports

Exports

Run

Sections

.text
Size: 76KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f4bcde8273754171e396ac6581297442

Headers

File Characteristics

Imports

kernel32

user32

advapi32

wininet

urlmon

Exports

Exports

Sections

.text Size: 76KB - Virtual size: 74KB

.rdata Size: 20KB - Virtual size: 17KB

.data Size: 12KB - Virtual size: 15KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 76KB - Virtual size: 74KB

.rdata
Size: 20KB - Virtual size: 17KB

.data
Size: 12KB - Virtual size: 15KB

.reloc
Size: 8KB - Virtual size: 7KB