466d8d07c04633389fa5e4278378312f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

466d8d07c04633389fa5e4278378312f_JaffaCakes118
Size

95KB
MD5

466d8d07c04633389fa5e4278378312f
SHA1

cf247a25f2ab64a0be2a10ac6540f370808dee6a
SHA256

19391f33a422af63dd36faa4c032f0a37c5e15064d6fad1a8e5728ec1bc240f1
SHA512

42018258a0283a96a624445afd51016fd5932181f637dfa5b28f89e7aa96c22cc5428a6b0d3110af6af4bcc2c0a26182c49c9904182833f52f256c7b5fe1b7e2
SSDEEP

1536:xJDhWy7OP9Qx/552aTqZ5sJm9Txt8ou8JO2WI6T75b0G:xJDhWy7OP9QMcJS8o0I6T75b0G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
466d8d07c04633389fa5e4278378312f_JaffaCakes118

Files

466d8d07c04633389fa5e4278378312f_JaffaCakes118
.dll windows:4 windows x86 arch:x86

5a0a1602915b638c301d26118dc4a34c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
GetLastError
InitializeCriticalSection
LeaveCriticalSection
CloseHandle
UnmapViewOfFile
EnterCriticalSection
MapViewOfFile
CreateFileMappingA
GetStartupInfoA
GetModuleFileNameA
FlushFileBuffers
HeapAlloc
HeapFree
RtlUnwind
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
ExitProcess
VirtualAlloc
HeapReAlloc
IsBadWritePtr
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
SetFilePointer
InterlockedDecrement
InterlockedIncrement
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
SetStdHandle
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

user32

CreateDialogParamA
ShowWindow
PostMessageA
DestroyWindow
GetWindowLongA
IsWindow
SendMessageA
GetParent
RegisterWindowMessageA

Exports

Exports

Windows_run
activateAccessibleHyperlink
addAccessibilityEventNotification
addAccessibleSelectionFromContext
addJavaEventNotification
clearAccessibleSelectionFromContext
doAccessibleActions
getAccessibleActions
getAccessibleChildFromContext
getAccessibleContextAt
getAccessibleContextFromHWND
getAccessibleContextInfo
getAccessibleContextWithFocus
getAccessibleHyperlink
getAccessibleHyperlinkCount
getAccessibleHypertext
getAccessibleHypertextExt
getAccessibleHypertextLinkIndex
getAccessibleIcons
getAccessibleKeyBindings
getAccessibleParentFromContext
getAccessibleRelationSet
getAccessibleSelectionCountFromContext
getAccessibleSelectionFromContext
getAccessibleTableCellInfo
getAccessibleTableColumn
getAccessibleTableColumnDescription
getAccessibleTableColumnHeader
getAccessibleTableColumnSelectionCount
getAccessibleTableColumnSelections
getAccessibleTableIndex
getAccessibleTableInfo
getAccessibleTableRow
getAccessibleTableRowDescription
getAccessibleTableRowHeader
getAccessibleTableRowSelectionCount
getAccessibleTableRowSelections
getAccessibleTextAttributes
getAccessibleTextInfo
getAccessibleTextItems
getAccessibleTextLineBounds
getAccessibleTextRange
getAccessibleTextRect
getAccessibleTextSelectionInfo
getActiveDescendent
getCaretLocation
getCurrentAccessibleValueFromContext
getEventsWaiting
getHWNDFromAccessibleContext
getMaximumAccessibleValueFromContext
getMinimumAccessibleValueFromContext
getObjectDepth
getParentWithRole
getParentWithRoleElseRoot
getTextAttributesInRange
getTopLevelObject
getVersionInfo
getVirtualAccessibleName
getVisibleChildren
getVisibleChildrenCount
isAccessibleChildSelectedFromContext
isAccessibleTableColumnSelected
isAccessibleTableRowSelected
isJavaWindow
isSameObject
releaseJavaObject
removeAccessibilityEventNotification
removeAccessibleSelectionFromContext
removeJavaEventNotification
requestFocus
selectAllAccessibleSelectionFromContext
selectTextRange
setCaretPosition
setCaretUpdateFP
setFocusGainedFP
setFocusLostFP
setJavaShutdownFP
setMenuCanceledFP
setMenuDeselectedFP
setMenuSelectedFP
setMouseClickedFP
setMouseEnteredFP
setMouseExitedFP
setMousePressedFP
setMouseReleasedFP
setPopupMenuCanceledFP
setPopupMenuWillBecomeInvisibleFP
setPopupMenuWillBecomeVisibleFP
setPropertyActiveDescendentChangeFP
setPropertyCaretChangeFP
setPropertyChangeFP
setPropertyChildChangeFP
setPropertyDescriptionChangeFP
setPropertyNameChangeFP
setPropertySelectionChangeFP
setPropertyStateChangeFP
setPropertyTableModelChangeFP
setPropertyTextChangeFP
setPropertyValueChangeFP
setPropertyVisibleDataChangeFP
setTextContents

Sections

.text
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5a0a1602915b638c301d26118dc4a34c

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 45KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 16KB - Virtual size: 19KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 48KB - Virtual size: 45KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 16KB - Virtual size: 19KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 4KB