2b368a83f194a7573b65657369d4db34_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2b368a83f194a7573b65657369d4db34_JaffaCakes118
Size

21KB
MD5

2b368a83f194a7573b65657369d4db34
SHA1

1366fbd4839b3c111368679ef482097bc3f959c5
SHA256

d0d4aff9f4c49f06a5db84c07f8af9d1a1a74f6255794d7bff0441e9f4c0a80b
SHA512

b508a14754994f1649d5f9cd7af2467cd3013782c217d9792b20f7c435e06c833de12484370be96dc1fc5d0a5dddd122e8ccc0e01b4cdc65179d2dc488ec6d47
SSDEEP

384:AuL2YPp3joJuU1/4ZySOgp2jM76R1weUNIjDKuvt:AutSbN4aI2jC6/ZJ/Ku

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b368a83f194a7573b65657369d4db34_JaffaCakes118

Files

2b368a83f194a7573b65657369d4db34_JaffaCakes118
.dll windows:4 windows x86 arch:x86

4969f92fe622684251bf9b852a22cdb9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileSize
lstrcatA
LocalFree
GetLastError
GetVersionExA
GlobalFree
GlobalAlloc
HeapFree
HeapAlloc
GetProcessHeap
SearchPathA
DeleteFileA
GetTickCount
FreeLibrary
lstrlenA
lstrcpyA
GetSystemDirectoryA
Process32Next
Process32First
CreateToolhelp32Snapshot
VirtualFreeEx
WaitForSingleObject
WriteProcessMemory
VirtualAllocEx
CreateRemoteThread
DuplicateHandle
GetCurrentProcess
VirtualProtectEx
OpenProcess
GetCurrentProcessId
CreateMutexA
CreateThread
ReleaseMutex
GetTempPathA
GetPrivateProfileStringA
FindFirstFileA
CreateFileA
WriteFile
ReadFile
GetModuleHandleA
Sleep
CloseHandle
GetModuleFileNameA
lstrcmpiA
LoadLibraryA
GetProcAddress

user32

wsprintfA
GetWindowTextA
GetForegroundWindow

gdi32

GetDeviceCaps
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteObject
DeleteDC
CreateDCA

advapi32

LookupPrivilegeValueA
SetSecurityInfo
SetEntriesInAclA
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges

msvcrt

memset
memcpy
strcat
strcpy
strstr
malloc
??2@YAPAXI@Z
sprintf
printf
strlen
_strlwr
mbstowcs
wcscmp
strrchr

msvcp60

?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z

wininet

HttpEndRequestA
InternetWriteFile
HttpSendRequestExA
InternetCloseHandle
HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetReadFile
HttpSendRequestA
InternetCrackUrlA
HttpAddRequestHeadersA

Exports

Exports

Install

Sections

.bss
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4969f92fe622684251bf9b852a22cdb9

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

msvcrt

msvcp60

wininet

Exports

Exports

Sections

.bss Size: - Virtual size: 4KB

.data Size: 18KB - Virtual size: 18KB

.reloc Size: 2KB - Virtual size: 1KB

.bss
Size: - Virtual size: 4KB

.data
Size: 18KB - Virtual size: 18KB

.reloc
Size: 2KB - Virtual size: 1KB