432fd227d558775fb563ae28f061f81d_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

432fd227d558775fb563ae28f061f81d_JaffaCakes118
Size

300KB
MD5

432fd227d558775fb563ae28f061f81d
SHA1

c41098c5738a87e86fbda6976cb1a3e30a10315a
SHA256

67654ae2c2dfe18dfbb89656a2ec978ab91a444e2a538153b8a217d4526498d2
SHA512

489e51777d1858f7d5cc8d8bd847a45e0dbdcbc4165ec9ff50b73a088dcc3c440edc7d36a68b435b5219d20573914c7b8a170f418b0ef657097ed3b43a153cf5
SSDEEP

6144:uS430SXoJ/RGWQonopBwj/mgGdbVHl6x3SttMx5XtAODB:l7E7a/AvHl6OMfd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
432fd227d558775fb563ae28f061f81d_JaffaCakes118

Files

432fd227d558775fb563ae28f061f81d_JaffaCakes118
.dll windows:4 windows x86 arch:x86

56bea06408f1e36aaca1f0d5a171fbc2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Dokumente und Einstellungen\Patrick\Desktop\ato\aTo pub new 1.3\Source\Release\aTo new pub.pdb

Imports

kernel32

TlsAlloc
SetFilePointer
WriteProcessMemory
OpenProcess
Sleep
VirtualProtect
QueryPerformanceCounter
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
CreateThread
ExitProcess
WritePrivateProfileStringA
GetPrivateProfileStringA
Module32Next
Module32First
CreateToolhelp32Snapshot
IsBadReadPtr
VirtualQuery
HeapAlloc
GetProcessHeap
GetOEMCP
GetACP
InterlockedExchange
InitializeCriticalSection
LCMapStringW
LCMapStringA
CloseHandle
FlushFileBuffers
ReadFile
GetLocaleInfoW
SetStdHandle
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
GetSystemInfo
VirtualAlloc
LoadLibraryA
IsBadCodePtr
WideCharToMultiByte
MultiByteToWideChar
TerminateProcess
GetCurrentProcess
RtlUnwind
RaiseException
GetLocalTime
GetCurrentThreadId
GetCommandLineA
GetVersionExA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetStringTypeW
SetLastError
GetLastError
TlsFree
TlsSetValue
TlsGetValue
SetUnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteFile
GetCPInfo
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
IsBadWritePtr

user32

GetAsyncKeyState
FindWindowA
GetWindowThreadProcessId

vstdlib

RandomSeed
RandomFloat
Q_strncpy
Q_snprintf
KeyValuesSystem
Q_strnicmp

tier0

Msg
g_VProfCurrentProfile
?GetSubNode@CVProfNode@@QAEPAV1@PBDH0H@Z
?EnterScope@CVProfNode@@QAEXXZ
?ExitScope@CVProfNode@@QAE_NXZ
Error
g_pMemAlloc
GetCPUInformation

Sections

.text
Size: 216KB - Virtual size: 215KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

56bea06408f1e36aaca1f0d5a171fbc2

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

vstdlib

tier0

Sections

.text Size: 216KB - Virtual size: 215KB

.rdata Size: 44KB - Virtual size: 43KB

.data Size: 12KB - Virtual size: 212KB

.reloc Size: 24KB - Virtual size: 21KB

.text
Size: 216KB - Virtual size: 215KB

.rdata
Size: 44KB - Virtual size: 43KB

.data
Size: 12KB - Virtual size: 212KB

.reloc
Size: 24KB - Virtual size: 21KB