3e66199246d1be5959ffd4aa09d1af4f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3e66199246d1be5959ffd4aa09d1af4f_JaffaCakes118
Size

89KB
MD5

3e66199246d1be5959ffd4aa09d1af4f
SHA1

b562f9b8ad8fd179457415b8269cf990057392e3
SHA256

71f86389dd6c8091d44952d12550866c023f2dfbfbec988f1889789a0d9ddbf2
SHA512

404718bfe018364b5077953cab7ce61402addd10c96065d0e4060ccecd35939fa2c1e6e832408fdbbaa53f9ced14c2d2d6121eb759ac8e3cb6e8841b264b7f51
SSDEEP

1536:SdC43h5GygwZMvezhF/cjaFalAHa1SDFR4SkMd5RgGKRCmWLyIYRd25kcPC:SdjDGygw18DAHa1SDFR4SkMHRkRCmYux

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e66199246d1be5959ffd4aa09d1af4f_JaffaCakes118

Files

3e66199246d1be5959ffd4aa09d1af4f_JaffaCakes118
.dll windows:4 windows x86 arch:x86

315c19d030b19439dffd3a8c6d16208a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

realloc
_snprintf
_initterm
time
strlen
srand
rand
malloc
strrchr
??3@YAXPAX@Z
??2@YAPAXI@Z
wcsstr
_strlwr
sscanf
memset
strcat
strstr
memcpy
wcsncpy
wcslen
strcpy
__CxxFrameHandler
strchr
strncpy
atoi
free
_except_handler3
_adjust_fdiv
_strcmpi
_stricmp

kernel32

WideCharToMultiByte
DisableThreadLibraryCalls
ExitProcess
CreateMutexA
GetLastError
WinExec
CloseHandle
GetProcAddress
GetModuleFileNameA
GetModuleHandleA
LoadLibraryA
OpenEventA
ReadFile
OutputDebugStringW
WritePrivateProfileStringA
VirtualProtect
GetCommandLineA
GetPrivateProfileStringA
IsBadReadPtr
lstrlenW
VirtualProtectEx

user32

wsprintfA
wvsprintfA

wininet

InternetReadFile

urlmon

URLDownloadToCacheFileA

Exports

Exports

WahCloseApcHelper
WahCloseHandleHelper
WahCloseNotificationHandleHelper
WahCloseSocketHandle
WahCloseThread
WahCompleteRequest
WahCreateHandleContextTable
WahCreateNotificationHandle
WahCreateSocketHandle
WahDestroyHandleContextTable
WahDisableNonIFSHandleSupport
WahEnableNonIFSHandleSupport
WahEnumerateHandleContexts
WahInsertHandleContext
WahNotifyAllProcesses
WahOpenApcHelper
WahOpenCurrentThread
WahOpenHandleHelper
WahOpenNotificationHandleHelper
WahQueueUserApc
WahReferenceContextByHandle
WahRemoveHandleContext
WahWaitForNotification

Sections

.text
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DDK0
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DDK1
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.cOU
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

315c19d030b19439dffd3a8c6d16208a

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

wininet

urlmon

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 30KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 20KB - Virtual size: 25KB

DDK0 Size: 4KB - Virtual size: 3KB

DDK1 Size: 16KB - Virtual size: 14KB

.reloc Size: 4KB - Virtual size: 3KB

.cOU Size: 512B - Virtual size: 512B

.text
Size: 32KB - Virtual size: 30KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 20KB - Virtual size: 25KB

DDK0
Size: 4KB - Virtual size: 3KB

DDK1
Size: 16KB - Virtual size: 14KB

.reloc
Size: 4KB - Virtual size: 3KB

.cOU
Size: 512B - Virtual size: 512B