3b4650648c9af1a50b3d1abd785307a9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3b4650648c9af1a50b3d1abd785307a9_JaffaCakes118
Size

70KB
MD5

3b4650648c9af1a50b3d1abd785307a9
SHA1

2e5ac4a5b43c33c410797c9e829851fa1044c18c
SHA256

40e5a4693bcb8152ae9a958348a5c84b0ab71e9f33bab35f3d55e0be9a49c64d
SHA512

5c4154cf17639030c05ad15c4c9b3d2eb6cc7d6cb3a0101080498bfd51b716567951f4b2e3b27172a5ff2ce76eb2bc3755e811f12ebd18a23158460076098c42
SSDEEP

768:4ku2aGoJ0BXkWyAPfIXV3kdgnZPLFKAOqXVQ3TjNQ9PotH57lBkXdBG54IZO554n:k2ToJ0BD3IFPPAoET+9Po157F4H55

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b4650648c9af1a50b3d1abd785307a9_JaffaCakes118

Files

3b4650648c9af1a50b3d1abd785307a9_JaffaCakes118
.dll windows:5 windows x86 arch:x86

d77988029082e8b83bd22a75f36a19bc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
GetProcAddress
LoadLibraryA
FreeLibrary
CreateFileA
VirtualProtect
GetCurrentThreadId
GetProcessHeap
GetModuleHandleW
ExitProcess
ExitThread
CloseHandle
GetLastError
ResumeThread
CreateThread
GetCommandLineA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
WriteFile
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
HeapFree
SetHandleCount
GetFileType
GetStartupInfoA
SetFilePointer
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA
HeapAlloc
VirtualAlloc
HeapReAlloc
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
MultiByteToWideChar
ReadFile
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile

user32

CallNextHookEx
wsprintfA
SetWindowsHookExA

Exports

Exports

GUICore
Init

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 667KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d77988029082e8b83bd22a75f36a19bc

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 49KB - Virtual size: 49KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 5KB - Virtual size: 667KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 49KB - Virtual size: 49KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 5KB - Virtual size: 667KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 6KB - Virtual size: 5KB