418ab2e2d0f04969c06e88f9fe63e05e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

418ab2e2d0f04969c06e88f9fe63e05e_JaffaCakes118
Size

48KB
MD5

418ab2e2d0f04969c06e88f9fe63e05e
SHA1

5a712b1dd5a88db3f2dd0c2fdd3b289622e1463d
SHA256

e34c17008625ce26d36b17f0a469c5f879f7d2c81c711242fd32f455cb18dfce
SHA512

209939219a60df97377f6e2a859f758467240c8fb7745be8257906030f9fbab957af6229cfd58bbdada924efe4c6de4b400a1c171528f0bd8f1695b711883c9f
SSDEEP

1536:5DjLLOoLtaxBSNoiqoWcgoCQjafyXUaYh+Yck+Oicx3TWq:FWiqoWcSZfyEa6+QDWq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
418ab2e2d0f04969c06e88f9fe63e05e_JaffaCakes118

Files

418ab2e2d0f04969c06e88f9fe63e05e_JaffaCakes118
.dll windows:4 windows x86 arch:x86

015171704cb90515ae25061683234dab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
GetModuleHandleA
VirtualProtect
GetCurrentProcess
CreateToolhelp32Snapshot
GetProcessHeap
HeapAlloc
OutputDebugStringA
Process32Next
lstrcmpiA
Process32First
OpenProcess
GetLastError
WriteFile
ReadFile
WideCharToMultiByte
MultiByteToWideChar
GetSystemDirectoryA
GetTickCount
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetTempPathA
lstrcpynA
ReadProcessMemory
SetThreadPriority
VirtualProtectEx
CopyFileA
DeviceIoControl
TerminateThread
GetFileAttributesA
MoveFileExA
ReleaseSemaphore
CreateSemaphoreA
GlobalAlloc
GlobalFree
SetEndOfFile
SetFilePointer
GetFileSize
GetProcAddress
GetCurrentProcessId
CreateMutexA
ReleaseMutex
CloseHandle
GetCurrentThreadId
lstrcpyA
FreeLibrary
LoadLibraryA
GetPrivateProfileStringA
CreateProcessA
ResumeThread
lstrlenA
CreateThread
Sleep
GetModuleFileNameA

user32

GetClassNameW
GetWindow
EnumWindows
PostMessageA
SetWindowsHookExA
wsprintfA
CallNextHookEx
PostThreadMessageA
FindWindowA
wvsprintfA
UnhookWindowsHookEx
GetWindowThreadProcessId
GetMessageA
GetForegroundWindow

gdi32

CreateDCA
GetDeviceCaps
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteDC
DeleteObject
BitBlt

advapi32

RegEnumKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumValueA

msvcrt

_onexit
_adjust_fdiv
_strnicmp
exit
_initterm
__dllonexit
_strcmpi
_strupr
_strdup
wcsstr
memset
strcat
strrchr
strcpy
??2@YAPAXI@Z
strstr
strlen
strncpy
sprintf
_except_handler3
free
_stricmp
malloc
memcpy
??3@YAXPAX@Z
wcscat
wcscpy
wcslen
rand
srand
isspace
isalnum
strchr
_vsnprintf
realloc
isdigit
isalpha
atoi
wcscmp
mbstowcs
_strlwr
wcsncat

gdiplus

GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipDisposeImage
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusStartup

msvcp60

??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ

wsock32

gethostbyname
send
closesocket
recv
connect
htons
socket
WSAStartup
shutdown

Exports

Exports

asdfghjkl
qwertyui

Sections

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

015171704cb90515ae25061683234dab

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

msvcrt

gdiplus

msvcp60

wsock32

Exports

Exports

Sections

.bss Size: - Virtual size: 3KB

.data Size: 43KB - Virtual size: 43KB

.reloc Size: 3KB - Virtual size: 2KB

.bss
Size: - Virtual size: 3KB

.data
Size: 43KB - Virtual size: 43KB

.reloc
Size: 3KB - Virtual size: 2KB