3564298c8a79f0655c1642927d4f6ed0_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

3564298c8a79f0655c1642927d4f6ed0_JaffaCakes118
Size

87KB
MD5

3564298c8a79f0655c1642927d4f6ed0
SHA1

2ca49c49bf3d34bad06fe6abd2456fdf5be81f90
SHA256

64a484bdcd6eb75a9d40f5d09e2d9421342e8e4a8df9e71b74b27b9b083615d9
SHA512

072d9b3345539f15c7a1d246f7a86c15304a4d6a2e2f52f84d6932b5eef09e74225cbe1dc7ea54ad954caddf4ae0683dfcd1a95eb8276b177b3f8d0995cfd6a7
SSDEEP

768:dsetreaOvYzU/x5R1Uxvz/VRva3IUAKrxYgVUmG2ANlQjc:HVeaOvYzU/xf16zVZa3IUAQNVDANlQj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3564298c8a79f0655c1642927d4f6ed0_JaffaCakes118

Files

3564298c8a79f0655c1642927d4f6ed0_JaffaCakes118
.dll .js windows:4 windows x86 arch:x86 polyglot

a2f3fe82adb2f7f19962ace17d674494

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

UnmapViewOfFile
lstrlenA
MapViewOfFile
CreateFileMappingA
IsBadStringPtrA
CloseHandle
OpenFileMappingA
CreateThread
WideCharToMultiByte
lstrlenW
GetTickCount
GetProcAddress
LoadLibraryA
GetTempPathA
GetVersionExA
WinExec
ExitProcess
lstrcatA
GetModuleFileNameA
GetCurrentDirectoryA
Module32Next
Module32First
CreateToolhelp32Snapshot
WritePrivateProfileStringA
GetCommandLineA
VirtualProtect
OpenProcess
TerminateProcess
ReadProcessMemory
VirtualProtectEx
WriteProcessMemory
GetCurrentProcess
VirtualAlloc
lstrcpyA
GetSystemDirectoryA
GetPrivateProfileStringA
GetModuleHandleA
Sleep
GetCurrentProcessId
IsBadReadPtr

user32

wsprintfA
MessageBoxA

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA

shlwapi

StrStrIA
PathFileExistsA
StrStrW
StrStrA

msvcrt

time
_memicmp
_adjust_fdiv
_initterm
isdigit
malloc
free
isprint
strlen
memcpy
strcpy
strcat
memset
strncmp
strcmp
sscanf
__CxxFrameHandler
strncpy
sprintf
rand
srand
_stricmp
_itoa
strstr
fopen
strrchr
fgetc
rewind
ftell
fseek
isspace
isalnum
atol

Exports

Exports

WahCloseApcHelper
WahCloseHandleHelper
WahCloseNotificationHandleHelper
WahCloseSocketHandle
WahCloseThread
WahCompleteRequest
WahCreateHandleContextTable
WahCreateNotificationHandle
WahCreateSocketHandle
WahDestroyHandleContextTable
WahDisableNonIFSHandleSupport
WahEnableNonIFSHandleSupport
WahEnumerateHandleContexts
WahInsertHandleContext
WahNotifyAllProcesses
WahOpenApcHelper
WahOpenCurrentThread
WahOpenHandleHelper
WahOpenNotificationHandleHelper
WahQueueUserApc
WahReferenceContextByHandle
WahRemoveHandleContext
WahWaitForNotification

Sections

sectionX
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a2f3fe82adb2f7f19962ace17d674494

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

msvcrt

Exports

Exports

Sections

sectionX Size: 2KB - Virtual size: 1KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 75KB - Virtual size: 75KB

.rsrc Size: 1024B - Virtual size: 880B

.reloc Size: 4KB - Virtual size: 4KB

sectionX
Size: 2KB - Virtual size: 1KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 75KB - Virtual size: 75KB

.rsrc
Size: 1024B - Virtual size: 880B

.reloc
Size: 4KB - Virtual size: 4KB