360aa5b48f3553b7196587dd605795d2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

360aa5b48f3553b7196587dd605795d2_JaffaCakes118
Size

144KB
MD5

360aa5b48f3553b7196587dd605795d2
SHA1

9a8d881a7ec66679b54e243d80f7be436e3e6ed9
SHA256

898f96c0a96f8ca8b5f102e46c7aaf9fe2ee0a595d843107e0d87856e5ba4f4c
SHA512

d1ac08f36cab24b4ab380f5ecefeba4c4d2cb3aeb078779619574ba2deee31499905b88b018743b14629108ab3f07dc194393301078c9b4e3b03dc6b61100461
SSDEEP

1536:oOOFrvWJ/c9m0C4vtx8dEYhZSTETiSrnFELUCuy3oOw6b0AcbN3b:BOFroc9J1vDmBRiYXy3anAcbh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
360aa5b48f3553b7196587dd605795d2_JaffaCakes118

Files

360aa5b48f3553b7196587dd605795d2_JaffaCakes118
.dll windows:4 windows x86 arch:x86

5024901f71dbcd380764b496dcb6ed9b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLocalTime
SetEndOfFile
LeaveCriticalSection
EnterCriticalSection
CreateFileA
DisableThreadLibraryCalls
InitializeCriticalSection
CreateThread
MultiByteToWideChar
GlobalFree
GlobalUnlock
GlobalHandle
WriteFile
SetFilePointer
GetLastError
CreateEventW
DeviceIoControl
CreateFileW
SetLastError
SetEvent
ReadFile
WaitForSingleObject
QueryPerformanceFrequency
QueryPerformanceCounter
GetFullPathNameW
GetCurrentProcessId
GetSystemDirectoryA
GetWindowsDirectoryA
WideCharToMultiByte
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetCurrentProcess
GetVersion
InterlockedCompareExchange
InterlockedIncrement
Sleep
ResumeThread
GlobalAlloc
GlobalLock
LocalFree
ExitProcess
DeleteCriticalSection
FlushFileBuffers
SetStdHandle
LoadLibraryA
GetOEMCP
GetACP
InterlockedDecrement
CloseHandle
GetStringTypeA
GetStringTypeW
CreateRemoteThread
OpenProcess
DuplicateHandle
VirtualAlloc
VirtualFree
ReadProcessMemory
WriteProcessMemory
VirtualQuery
GetExitCodeThread
SuspendThread
TerminateThread
GetThreadContext
SetThreadContext
LCMapStringW
lstrcmpiW
lstrcmpiA
RtlUnwind
HeapAlloc
HeapFree
GetCommandLineA
TlsGetValue
TlsFree
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
HeapReAlloc
TerminateProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
GetCPInfo
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
LCMapStringA

user32

MessageBoxA
GetWindowLongA
SendMessageA
GetClassNameA
GetWindowModuleFileNameA
GetWindowTextA
EnumChildWindows
wsprintfW
CallNextHookEx
GetParent
SetWindowsHookExA
ToAscii
GetKeyboardState
GetFocus
GetActiveWindow
UnhookWindowsHookEx
MessageBoxW

advapi32

OpenServiceW
OpenSCManagerW
LookupAccountSidA
RegCloseKey
RegSetValueExA
RegCreateKeyA
RegDeleteValueA
RegEnumValueA
RegOpenKeyA
GetUserNameA
CloseServiceHandle
CreateServiceW
ControlService
StartServiceW
QueryServiceStatus
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyW

ws2_32

ntohs

Exports

Exports

AddHiddenFileDir
AddHiddenKey
AddHiddenProcId
AddHiddenProcName
AddHiddenServ
AddHiddenTCPPort
AddHiddenUDPPort
AddHiddenUser
AddHiddenValue
Add_DLL
ApiHookChain
ConServerDllInitialization
DelHiddenFileDir
DelHiddenKey
DelHiddenProcId
DelHiddenProcName
DelHiddenServ
DelHiddenTCPPort
DelHiddenUDPPort
DelHiddenUser
DelHiddenValue
GetHiddenFileDirName
GetHiddenKeyName
GetHiddenProcId
GetHiddenProcName
GetHiddenServName
GetHiddenTCPPort
GetHiddenUDPPort
GetHiddenUserName
GetHiddenValueName
Hook_Start
Hook_Stop
HooksCanUnloadNow
KeyLog_Start
KeyLog_Stop
PacketAllocatePacket
PacketCloseAdapter
PacketFreePacket
PacketGetAdapterNames
PacketGetNetInfo
PacketGetNetInfoEx
PacketGetNetType
PacketGetReadEvent
PacketGetStats
PacketGetStatsEx
PacketGetVersion
PacketInitPacket
PacketIsDumpEnded
PacketLibraryVersion
PacketOpenAdapter
PacketReceivePacket
PacketRequest
PacketSendPacket
PacketSendPackets
PacketSetBpf
PacketSetBuff
PacketSetDumpLimits
PacketSetDumpName
PacketSetHwFilter
PacketSetMinToCopy
PacketSetMode
PacketSetNumWrites
PacketSetReadTimeout
PacketStopDriver

Sections

.text
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

ApiHooks
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PrcWorks
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARDAT
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5024901f71dbcd380764b496dcb6ed9b

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ws2_32

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 52KB

ApiHooks Size: 16KB - Virtual size: 12KB

PrcWorks Size: 4KB - Virtual size: 2KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 20KB - Virtual size: 49KB

.SHARDAT Size: 28KB - Virtual size: 26KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 56KB - Virtual size: 52KB

ApiHooks
Size: 16KB - Virtual size: 12KB

PrcWorks
Size: 4KB - Virtual size: 2KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 20KB - Virtual size: 49KB

.SHARDAT
Size: 28KB - Virtual size: 26KB

.reloc
Size: 8KB - Virtual size: 6KB