32d2cd705bc0b296f39e65635c1ddd2a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

32d2cd705bc0b296f39e65635c1ddd2a_JaffaCakes118
Size

220KB
MD5

32d2cd705bc0b296f39e65635c1ddd2a
SHA1

4be63f55252619ebec32d0684ca508c05cd59d4d
SHA256

92bd7a0454e4fe66deee8a50d7aaece8fec95591f1301194d11b5cc613bc5498
SHA512

fd0e37aea13568eb52dc8aa13418ac42add0f09d8ccf8b73028109a55f670c37e22331190a48e3d4fdd6c2d41395f9ef8597f944ec359dd88e23d75cad3becf2
SSDEEP

3072:BEMKAF4SW69SGvDS6q+OAFnKUMexlYIzvvy3n25SXLR:DKa4H6/fxdKUM9p/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
32d2cd705bc0b296f39e65635c1ddd2a_JaffaCakes118

Files

32d2cd705bc0b296f39e65635c1ddd2a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5d876db4e82010677ac190bd4b24cadb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Visual C++ Projekte\Dll_Injector\Release\Dll_Injector.pdb

Imports

kernel32

OutputDebugStringA
GetProcAddress
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
ExitProcess
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsAlloc
SetLastError
GetCurrentThreadId
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
IsBadWritePtr
RtlUnwind
InterlockedExchange
VirtualQuery
LCMapStringA
MultiByteToWideChar
LCMapStringW
SetConsoleCtrlHandler
HeapSize
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
VirtualProtect
GetSystemInfo
GetTimeZoneInformation
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetStdHandle
SetFilePointer
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
Thread32Next
Thread32First
FindFirstFileA
OpenProcess
Sleep
CreateThread
CreateMutexA
GlobalFree
ReadProcessMemory
GlobalAlloc
SetThreadContext
SuspendThread
ResumeThread
WriteProcessMemory
VirtualProtectEx
GetThreadContext
GetExitCodeThread
WaitForSingleObject
CreateRemoteThread
GetVersion
FlushFileBuffers

mscoree

_CorExeMain

user32

GetAsyncKeyState
MessageBoxA

psapi

GetModuleBaseNameA

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 84KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5d876db4e82010677ac190bd4b24cadb

Headers

File Characteristics

PDB Paths

Imports

kernel32

mscoree

user32

psapi

Sections

.text Size: 60KB - Virtual size: 59KB

.rdata Size: 60KB - Virtual size: 56KB

.data Size: 4KB - Virtual size: 16KB

.rsrc Size: 84KB - Virtual size: 81KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 60KB - Virtual size: 59KB

.rdata
Size: 60KB - Virtual size: 56KB

.data
Size: 4KB - Virtual size: 16KB

.rsrc
Size: 84KB - Virtual size: 81KB

.reloc
Size: 8KB - Virtual size: 4KB