4304234f2d483734ff5615429719acc7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4304234f2d483734ff5615429719acc7_JaffaCakes118
Size

110KB
MD5

4304234f2d483734ff5615429719acc7
SHA1

d8e56c6e62c0d44998844dcfe6d76bfd321b0f4a
SHA256

a79af43e5bd013facd02ee47fd0c49b8ae5baa9ddfabf90ce4d42038ae073d29
SHA512

064b3a2f3a1e01d0775180e005ac9e5ff84a41d19b9a7c97cffd4e4094ac3b1444c85c8668fcfb43aa7d7e230c517017de2086d53962d2332810ff3e47bebd7a
SSDEEP

1536:Ykv/bxhmyqkQ06meU2e4VS0+gahFzxXrtKxnqYbxnNBGNk+T2pKgJf:Yk3bvmyJQkiahFzxcBZGNk+yKgV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4304234f2d483734ff5615429719acc7_JaffaCakes118

Files

4304234f2d483734ff5615429719acc7_JaffaCakes118
.exe windows:5 windows x86 arch:x86

dfc5c01a82d657a616b1e4b4e65e5b2f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\NightMAREK\Desktop\Night Tibia Keylogger\ntktest.xaa.pl LOG PAS LVL\ntktest.xaa.pl LOG PAS LVL ALL IN ONE\Release\987.pdb

Imports

wininet

InternetCloseHandle
InternetOpenA
InternetOpenUrlA

kernel32

OpenProcess
Sleep
ReadProcessMemory
GetEnvironmentVariableA
Module32First
LoadLibraryW
CloseHandle
HeapReAlloc
WriteConsoleW
SetStdHandle
CreateToolhelp32Snapshot
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
MultiByteToWideChar
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
GetCommandLineA
HeapSetInformation
GetCPInfo
RaiseException
RtlUnwind
HeapAlloc
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
CreateFileW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeW
GetLocaleInfoW
HeapSize
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
SetFilePointer
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale

user32

FindWindowA
GetWindowThreadProcessId

advapi32

RegOpenKeyExA
RegSetValueExA
RegCloseKey

Sections

.text
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dfc5c01a82d657a616b1e4b4e65e5b2f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wininet

kernel32

user32

advapi32

Sections

.text Size: 82KB - Virtual size: 82KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 6KB - Virtual size: 14KB

.rsrc Size: 512B - Virtual size: 436B

.text
Size: 82KB - Virtual size: 82KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 6KB - Virtual size: 14KB

.rsrc
Size: 512B - Virtual size: 436B