29231ec27a176ca20352c6ae923d2494_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

29231ec27a176ca20352c6ae923d2494_JaffaCakes118
Size

18KB
MD5

29231ec27a176ca20352c6ae923d2494
SHA1

5a740a1290bce2d05585848026f45994b271c46f
SHA256

543fd3717968389ff55b2428753bbc4745dc0fcbb24642b33d2cd602db18946a
SHA512

5bfe88754939131f7ac24b82d9c616c371b9cb4f1c4c44aa484516604d0249f5df8d56dd1d7942da6a05c6ccc2c91e3a014cfd175e45a3ddc4d54288b1d389e5
SSDEEP

384:kB1Ga3nQcWEXBXdzuQe0/6CdOgH0gdQQWWK1jBTZ:A3nhdPzlTOQtqWK1b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29231ec27a176ca20352c6ae923d2494_JaffaCakes118

Files

29231ec27a176ca20352c6ae923d2494_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b6ef357a42fe09f2ddf4fdf85c2f3bff

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wsock32

htons
inet_addr
gethostbyname
recv
inet_ntoa
WSAStartup
ioctlsocket
send
socket
connect
WSACleanup
closesocket

user32

SetClipboardData
CloseClipboard
keybd_event
SetFocus
EmptyClipboard
OpenClipboard
VkKeyScanA
SetForegroundWindow
wsprintfA
BlockInput
ShowWindow

advapi32

EnumServicesStatusA
CloseServiceHandle
OpenProcessToken
ImpersonateLoggedOnUser
OpenSCManagerA

wininet

InternetOpenUrlA
InternetOpenA
InternetReadFile

msvcrt

fopen
_onexit
__dllonexit
sprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
rand
srand
strstr
strncpy
malloc
time
fclose
fwrite
strtok
atoi
free
_initterm
_adjust_fdiv

ole32

CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

SysFreeString
SysAllocString
VariantClear
VariantInit

psapi

GetModuleBaseNameA
EnumProcesses
EnumProcessModules

kernel32

CreateFileA
CreateThread
CreateProcessA
LoadLibraryA
GetProcAddress
lstrcpyA
lstrlenA
lstrcmpA
lstrcpynA
CreateMutexA
GlobalUnlock
OpenProcess
lstrcmpiA
GetLocaleInfoA
Sleep
GetTickCount
InterlockedDecrement
GetWindowsDirectoryA
GlobalAlloc
DisableThreadLibraryCalls
MultiByteToWideChar
GetLastError
CloseHandle
GlobalLock

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b6ef357a42fe09f2ddf4fdf85c2f3bff

Headers

File Characteristics

Imports

wsock32

user32

advapi32

wininet

msvcrt

ole32

oleaut32

psapi

kernel32

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 2KB

.reloc Size: 1024B - Virtual size: 904B

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1024B - Virtual size: 904B