35dd021060fa02481efde1af10efebd9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

35dd021060fa02481efde1af10efebd9_JaffaCakes118
Size

100KB
MD5

35dd021060fa02481efde1af10efebd9
SHA1

2fce65c56632092933503fa339d3769edddcafcc
SHA256

2055682ece99e0dc954851bb38f0552aa999716814235157552b6ea2cd17ee68
SHA512

b6de8bf7234284c7046db80364077eedde1012e989b37d00bb4c8df5aeffe760637c8d35d2c24da96549d5d855e28409b061fa82875057c1799d277b0550ea5e
SSDEEP

1536:RoMM6/JjEM0Gs60BIZGOMyORKG2aY3SEgXRGXFnckFDvjS/oFunNdzEHZhI615:RoUJ7s6YI5MyO83SQncODlyEHZhI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
35dd021060fa02481efde1af10efebd9_JaffaCakes118

Files

35dd021060fa02481efde1af10efebd9_JaffaCakes118
.dll windows:4 windows x86 arch:x86

d301ac8b61b046cfeb01a7b526ae8963

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

AccessCheck
BuildImpersonateExplicitAccessWithNameA
LookupPrivilegeDisplayNameW
OpenThreadToken
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegOpenKeyW
RegQueryValueExW

gdi32

ExtEscape
AddFontResourceExA

kernel32

CloseHandle
CreateThread
EnterCriticalSection
GetConsoleWindow
GetCurrentThread
GetLastError
GetStartupInfoA
HeapFree
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
lstrcpyW
lstrlenW
VirtualAlloc
LoadResource
FindResourceA
CreateFileMappingW
FindClose
FindFirstFileW
GetCurrentThreadId
LocalAlloc
LocalFree
MapViewOfFile
UnmapViewOfFile
CompareStringW
CompareStringA
GetLocaleInfoW
GetSystemInfo
VirtualProtect
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
HeapSize
LoadLibraryA
VirtualQuery
InterlockedExchange
SetEnvironmentVariableA
RtlUnwind
GetCommandLineA
GetVersionExA
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
WriteFile
FatalAppExitA
GetACP
GetOEMCP
GetCPInfo
HeapReAlloc
IsBadWritePtr
InitializeCriticalSection

ole32

HDC_UserUnmarshal
CoTaskMemAlloc
HGLOBAL_UserMarshal

rpcrt4

MesDecodeBufferHandleCreate
RpcImpersonateClient
RpcRevertToSelf
RpcServerInqDefaultPrincNameW
RpcServerRegisterAuthInfoW
RpcServerRegisterIfEx
RpcBindingFree

user32

GetWindowLongW
GetWindowLongA
GetDlgItem
GetWindowThreadProcessId
DefWindowProcW
CallWindowProcW
DlgDirSelectComboBoxExW
LoadStringW
MessageBoxW
PeekMessageW
SendMessageW
SendNotifyMessageW
SetWindowLongW
DispatchMessageW
SetWindowTextW

Exports

Exports

XXFJCCKDEYV

Sections

.text
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d301ac8b61b046cfeb01a7b526ae8963

Headers

File Characteristics

Imports

advapi32

gdi32

kernel32

ole32

rpcrt4

user32

Exports

Exports

Sections

.text Size: 55KB - Virtual size: 54KB

.rdata Size: 13KB - Virtual size: 12KB

.data Size: 27KB - Virtual size: 27KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 55KB - Virtual size: 54KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 27KB - Virtual size: 27KB

.reloc
Size: 4KB - Virtual size: 3KB