282c47c5dd4b73d928a5820848d6ff24_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

282c47c5dd4b73d928a5820848d6ff24_JaffaCakes118
Size

3.2MB
MD5

282c47c5dd4b73d928a5820848d6ff24
SHA1

bf408846a3585993dcad044f2122417089c5074b
SHA256

db5519dc5cef09652e918a2c105fc40191c5d35b719ffa6bfefb3ee8d89f2211
SHA512

ec5ebf8dccac149f54e8f7c0efc39c8b0c22938cd2da6baab26d2ffd0f25f310cd5bf5cf704eba68847df2cecbfeba6933be65dd1f9ec54ff8adc3a3f34b0e8f
SSDEEP

49152:oDVFQdCRxlST2a0MtR3DTZ7r4iqkAsdotN5GNP+NCu8kw/j/b5Ye/Q8B/+QRemj1:1kX9a0Mr31AsdOPJNYkbCBml

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
282c47c5dd4b73d928a5820848d6ff24_JaffaCakes118

Files

282c47c5dd4b73d928a5820848d6ff24_JaffaCakes118
.dll windows:6 windows x86 arch:x86

db286aef1844e858969f954b37476ab2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ole32

CoTaskMemRealloc
CoAllowSetForegroundWindow

kernel32

DeleteCriticalSection
CloseHandle
FindFirstChangeNotificationA
SetFileApisToANSI
CreateFileMappingW
LocalAlloc
DeleteFileW
EnterCriticalSection
ReadFileEx
LocalLock
GetComputerNameExW
CreateJobObjectA
LocalHandle
CreateEventA
WideCharToMultiByte
TlsSetValue
WriteFile
ClearCommBreak
GetCurrencyFormatA
FormatMessageA
VirtualFree
SetCommBreak
SetEvent
FindCloseChangeNotification
SetInformationJobObject
GetCommandLineW
LocalFree
ResetEvent
CreateFileW
SetEnvironmentVariableA
CompareStringW
WriteConsoleW
GetTimeZoneInformation
GetProcessHeap
SetEndOfFile
GetDriveTypeW
GetStringTypeW
LCMapStringW
RtlUnwind
GetLastError
SetLastError
SystemTimeToFileTime
GetSystemTime
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
InterlockedCompareExchange
TlsAlloc
TlsGetValue
TlsFree
GetCurrentThreadId
InterlockedExchangeAdd
DeleteFiber
SwitchToFiber
CreateFiber
FindNextFileW
FindFirstFileW
MultiByteToWideChar
FindClose
GetProcAddress
GetModuleHandleW
GetVersion
GetFileType
GetStdHandle
ConvertFiberToThread
ConvertThreadToFiber
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
FreeLibrary
LoadLibraryA
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
TerminateProcess
GetCurrentProcess
HeapFree
HeapAlloc
GetCommandLineA
RaiseException
HeapReAlloc
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
ExitProcess
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleFileNameW
Sleep
HeapSize
SetHandleCount
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount
GetFullPathNameA
GetFileInformationByHandle
PeekNamedPipe
CreateFileA
GetCurrentDirectoryW
ReadFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetStdHandle
SetFilePointer

user32

GetDlgCtrlID
ShowWindow
DestroyCursor
RedrawWindow
GetDlgItem
InvalidateRect
SetWindowLongA
GetWindowTextA
GetMenu
SendMessageA
SetMenu
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation

gdi32

EndPath
BeginPath
PolyPolygon
PolyBezier
CreatePen
SetPolyFillMode
Polygon
SelectClipPath

advapi32

CryptSignHashW
ReportEventW
RegisterEventSourceW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
CryptEnumProvidersW
LsaFreeMemory
RegSetValueExW
SetUserFileEncryptionKey
BackupEventLogW
FreeSid
AllocateAndInitializeSid
LsaClose
RegQueryValueExW
LsaAddAccountRights
FlushTraceW
CopySid
EncryptionDisable
GetKernelObjectSecurity
LsaEnumerateAccountRights
LsaOpenPolicy
ConvertStringSidToSidA
SetThreadToken
PrivilegedServiceAuditAlarmA
CryptDestroyKey
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDestroyHash
DeregisterEventSource
CryptSetHashParam
CryptCreateHash
CryptDecrypt

ws2_32

send
WSASetLastError
recv
WSAGetLastError
WSACleanup
closesocket

crypt32

CertGetCertificateContextProperty
CertFreeCertificateContext
CertOpenStore
CertFindCertificateInStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertCloseStore

Exports

Exports

PrivateMasters
c_islower
c_ispunct
careadlinkatcwd
find_executable
fixup_null_alloc
npgettext_aux
rpl_stat
sigemptyset
xreadlink

Sections

.text
Size: 996KB - Virtual size: 996KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 262KB - Virtual size: 261KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

db286aef1844e858969f954b37476ab2

Headers

DLL Characteristics

File Characteristics

Imports

ole32

kernel32

user32

gdi32

advapi32

ws2_32

crypt32

Exports

Exports

Sections

.text Size: 996KB - Virtual size: 996KB

.rdata Size: 262KB - Virtual size: 261KB

.data Size: 2.0MB - Virtual size: 2.0MB

.reloc Size: 42KB - Virtual size: 42KB

.text
Size: 996KB - Virtual size: 996KB

.rdata
Size: 262KB - Virtual size: 261KB

.data
Size: 2.0MB - Virtual size: 2.0MB

.reloc
Size: 42KB - Virtual size: 42KB