2eabf7617836a14ab00a8bb2088f20fe_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2eabf7617836a14ab00a8bb2088f20fe_JaffaCakes118
Size

64KB
MD5

2eabf7617836a14ab00a8bb2088f20fe
SHA1

7400df84a1ad99231cf348ad1da6570e5138a56d
SHA256

cce9adba7f8f09ecc5aea3956c61582d868b090c2a41150d8f0a7e6969abc399
SHA512

fe20440aabc21b3fa9928626e3f5dda61cf2fcbe366bb71b62f8718b8f4d00baaa1f573e18f616cacadfdc0aa585a584b2b0fb76c04ee9bf615ed72e6725309c
SSDEEP

1536:hz5drNQOQYeI/vzswiA0ZTEGZbUinl1Adr63UW3z3Ei1qdCtHYLY:zTViI/7swiA0ZhZ4ibAsEW3z3Ei1qdC3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2eabf7617836a14ab00a8bb2088f20fe_JaffaCakes118

Files

2eabf7617836a14ab00a8bb2088f20fe_JaffaCakes118
.dll windows:4 windows x86 arch:x86

0421c3cc0ea7fcac44d86265fcbac170

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
AddVectoredExceptionHandler
InitializeCriticalSection
IsBadReadPtr
LeaveCriticalSection
EnterCriticalSection
VirtualProtect
FlushInstructionCache
GetCurrentProcess
Thread32Next
SetThreadContext
GetThreadContext
OpenThread
Thread32First
CreateToolhelp32Snapshot
GetProcessHeap
HeapAlloc
OutputDebugStringA
Process32Next
lstrcmpiA
Process32First
OpenProcess
GetLastError
WriteFile
ReadFile
lstrcatA
GetTickCount
GetSystemDirectoryA
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
lstrlenA
GetTempPathA
lstrcpynA
ReadProcessMemory
SetThreadPriority
DeviceIoControl
GetFileAttributesA
MoveFileExA
CopyFileA
ReleaseSemaphore
CreateSemaphoreA
GlobalAlloc
GlobalFree
SetEndOfFile
SetFilePointer
GetFileSize
GetProcAddress
GetCurrentProcessId
CreateMutexA
ReleaseMutex
CloseHandle
GetCurrentThreadId
lstrcpyA
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetModuleFileNameA
CreateThread
Sleep
GetCommandLineA
MultiByteToWideChar
WideCharToMultiByte

user32

GetClassNameW
GetWindow
EnumWindows
wvsprintfA
GetForegroundWindow
SetWindowsHookExA
wsprintfW
CallNextHookEx
PostThreadMessageA
PostMessageA
wsprintfA
UnhookWindowsHookEx
GetWindowThreadProcessId
GetMessageA
FindWindowA

gdi32

CreateDCA
GetDeviceCaps
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteDC
DeleteObject

advapi32

RegEnumKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumValueA

msvcrt

_strnicmp
__dllonexit
exit
_initterm
_adjust_fdiv
wcsstr
_onexit
_strcmpi
_strupr
_strdup
wcsncat
memset
strcpy
fclose
fgets
fopen
strncpy
strchr
strstr
wcsncpy
??2@YAPAXI@Z
strcat
strrchr
_except_handler3
free
_stricmp
strlen
malloc
memcpy
??3@YAXPAX@Z
wcscat
wcscpy
wcslen
rand
srand
sprintf
isspace
isalnum
_vsnprintf
realloc
isdigit
isalpha
atoi
wcscmp
mbstowcs
_strlwr

gdiplus

GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipDisposeImage
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusStartup

msvcp60

??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ

wsock32

gethostbyname
send
closesocket
recv
connect
htons
socket
WSAStartup
shutdown

psapi

GetModuleFileNameExA
EnumProcessModules

Exports

Exports

asdfghjkl
qwertyui

Sections

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0421c3cc0ea7fcac44d86265fcbac170

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

msvcrt

gdiplus

msvcp60

wsock32

psapi

Exports

Exports

Sections

.bss Size: - Virtual size: 3KB

.data Size: 47KB - Virtual size: 47KB

.reloc Size: 3KB - Virtual size: 2KB

.bss
Size: - Virtual size: 3KB

.data
Size: 47KB - Virtual size: 47KB

.reloc
Size: 3KB - Virtual size: 2KB