42507e8d57b7507a2929b019a5f439a0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

42507e8d57b7507a2929b019a5f439a0_JaffaCakes118
Size

35KB
MD5

42507e8d57b7507a2929b019a5f439a0
SHA1

c763337f78bca7afbacea4ab75613da37fe14943
SHA256

2ee5c2ba62ab9e2385ca855a28e34e618688004cbabc18062e765366b4cc1d1b
SHA512

ecd841c239679852d3d21adc68f7d293d3419902395455021f0692cf7d1ee26e3cfc887f7098a6666d35ec3e6bcf87d36476fb30e9c7e99ec5dfbb12f631dc27
SSDEEP

384:77oBEsEe8p2TprU7GRHv+GttPW20vX70coY/XTFcE9cq6zMfNzJ:77ScUmGRmcgpvobOXTFcMz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42507e8d57b7507a2929b019a5f439a0_JaffaCakes118

Files

42507e8d57b7507a2929b019a5f439a0_JaffaCakes118
.dll windows:4 windows x86 arch:x86

f9fa33afc86a67b13e5802a1e186b675

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
SetFilePointer
GetProcAddress
OutputDebugStringA
HeapAlloc
GetProcessHeap
GetModuleHandleA
lstrcpynA
GetModuleFileNameA
FreeLibrary
GetFileSize
ReadFile
WideCharToMultiByte
VirtualQueryEx
ReadProcessMemory
GetFileAttributesW
CloseHandle
GetTempPathA
DeleteFileA
Sleep
GetCurrentProcessId
OpenProcess
TerminateProcess
GetCurrentProcess
IsBadReadPtr
lstrlenA
LoadLibraryA

user32

GetDC
GetWindowRect
wvsprintfA
GetWindowTextA
FindWindowA
wsprintfA
GetWindow
GetClassNameW

advapi32

CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash

msvcrt

_strupr
free
strcpy
memset
malloc
??3@YAXPAX@Z
wcscmp
??2@YAPAXI@Z
fclose
ftell
fseek
fopen
mbstowcs
strlen
_except_handler3
memmove
sprintf
memcpy
strchr
strstr
isprint
strcat
rand
srand
time
wcslen
wcsncat
wcscpy
wcsstr
strncpy
_stricmp
strrchr
exit
printf
__CxxFrameHandler
strcmp
_vsnprintf
realloc
isdigit
isalpha
atoi
_strcmpi
_strdup

wininet

InternetCloseHandle

wsock32

connect
send
WSAStartup
socket
htons
closesocket
recv
gethostbyname

gdiplus

GdipGetImageEncoders
GdipGetImageEncodersSize

gdi32

DeleteDC
DeleteObject
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetDeviceCaps
CreateDCA

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f9fa33afc86a67b13e5802a1e186b675

Headers

File Characteristics

Imports

kernel32

user32

advapi32

msvcrt

wininet

wsock32

gdiplus

gdi32

Sections

.text Size: 18KB - Virtual size: 18KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 3KB - Virtual size: 5.0MB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 18KB - Virtual size: 18KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 3KB - Virtual size: 5.0MB

.reloc
Size: 10KB - Virtual size: 9KB