38a68a8ba0ce98e55167864675bf5115_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

38a68a8ba0ce98e55167864675bf5115_JaffaCakes118
Size

171KB
MD5

38a68a8ba0ce98e55167864675bf5115
SHA1

0825a781688e33a890220fc6f2a0470087b4aea6
SHA256

ef544e2e0c2847022d5d94eb56b00a16fc32d064bbd731500a190a8f5965af9b
SHA512

635facae328f8ea7b2c21061ed360050d3247815e823a71e96edb3da4b4197e9a6b8af4e84d114a09f6643fea9e489f1463f2deb0db809df7c184490cc106b89
SSDEEP

3072:lHUbFVzEtYRpq+eczMVSkrJiSYTF2VIKOr2ZA3XhvUuwU4ineHlBdiqzNND3SsH:ljtOqLczirTIuOLpUbiqXl1J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
38a68a8ba0ce98e55167864675bf5115_JaffaCakes118

Files

38a68a8ba0ce98e55167864675bf5115_JaffaCakes118
.dll windows:5 windows x86 arch:x86

764620afe9c2c31380952037d92c6099

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

?terminate@@YAXXZ
sscanf
_wcslwr
wcsncpy
__setusermatherr
__set_app_type
__p__commode
wcstol
__pioinfo
_CxxThrowException
__p__fmode
isxdigit
_vsnprintf
strncmp
_itoa

kernel32

CreateDirectoryW
GetCurrentThreadId
QueryPerformanceCounter
GetDriveTypeA
GetSystemTimeAsFileTime
ExitProcess
FindResourceA
FindResourceW
GetExitCodeProcess
IsBadReadPtr
GetCurrentThread
SetLastError
GetCurrentProcessId
GetVersion
FreeEnvironmentStringsA
GetProcessHeap
CreateEventW
CreateFileA
OpenMutexW
GetModuleHandleW
DuplicateHandle
HeapSize
GetCurrentProcess
VirtualAlloc
DeviceIoControl

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoW
VerFindFileW

ole32

ReleaseStgMedium
CLSIDFromString
StringFromIID
CoTaskMemRealloc
CoGetMalloc
CoFreeUnusedLibraries
CoRevokeClassObject
CLSIDFromProgID
CoCreateGuid
PropVariantClear
CoGetClassObject
CoInitialize
CoCreateInstanceEx
ProgIDFromCLSID
CreateDataAdviseHolder

shlwapi

SHSetValueW
SHDeleteValueA
StrCpyNW
PathRemoveFileSpecA
StrToIntExW
SHGetValueW
StrStrIA
PathStripToRootA
StrStrW
PathStripToRootW
SHStrDupW

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 242KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 490B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

764620afe9c2c31380952037d92c6099

Headers

File Characteristics

Imports

msvcrt

kernel32

version

ole32

shlwapi

Sections

.text Size: 5KB - Virtual size: 4KB

.rdata Size: 52KB - Virtual size: 52KB

.data Size: 51KB - Virtual size: 242KB

.idata Size: 61KB - Virtual size: 61KB

.reloc Size: 512B - Virtual size: 490B

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 52KB - Virtual size: 52KB

.data
Size: 51KB - Virtual size: 242KB

.idata
Size: 61KB - Virtual size: 61KB

.reloc
Size: 512B - Virtual size: 490B