4935bb3e698cee9540860064c006b8a7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4935bb3e698cee9540860064c006b8a7_JaffaCakes118
Size

111KB
MD5

4935bb3e698cee9540860064c006b8a7
SHA1

9703e3dc6edef93f47a6f932560d0216021c10f5
SHA256

c6dff42c8652a05d14f14a4e98cdd06179448e57cc42f88f49e3e065fa8d3870
SHA512

977d80a1c669d402c18d9fd7b3c35fe510d01014e659a6997fbdfde78dedb158015b886896cd30e261ccefb6331b906d3cdc69450b64b1b7bde8d78609bcf3de
SSDEEP

1536:6xvIQ65VaIBNta98KMq5/4qlKW2ea5CWflkKXEq8WP6x++et:svI53aGTq54qlKW+/XF8WiI+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4935bb3e698cee9540860064c006b8a7_JaffaCakes118

Files

4935bb3e698cee9540860064c006b8a7_JaffaCakes118
.dll windows:4 windows x86 arch:x86

f615effb586d7d8635cad45f5a2b8c13

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crtdll

memset
strcpy
strlen
strcat
memcpy
memmove
sprintf
strncpy
fopen
malloc
free
fclose
exit
fprintf
fwrite
fflush
ferror
getenv
sscanf
fseek
strncmp
localtime
mktime
gmtime
floor
_iob
_setjmp
_isnan
_lseek
_close
_fstat
_open
_read
_write

user32

GetSystemMetrics
GetDesktopWindow
GetDC
SetCursorPos
BlockInput
SwapMouseButton
SetWindowPos
FindWindowA
SendMessageA
EnumWindows
ShowWindow
SetForegroundWindow
SetActiveWindow
SetWindowTextA
EnableWindow
GetCursorPos
GetForegroundWindow
GetMessageExtraInfo
mouse_event
MapVirtualKeyA
keybd_event
GetAsyncKeyState
GetKeyState
ToAscii
GetWindowTextA
SystemParametersInfoA
GetWindowLongA
DestroyIcon
FillRect
GetWindowTextLengthA
CallWindowProcA
GetPropA
CreateWindowExA
SetWindowLongA
IsWindowEnabled
GetSysColor
GetSysColorBrush
PostMessageA
SetFocus
DestroyWindow
TranslateMessage
DispatchMessageA
PeekMessageA
RemovePropA
SetPropA
GetParent
RedrawWindow
GetWindow
UnregisterClassA
DestroyAcceleratorTable
LoadIconA
LoadCursorA
RegisterClassA
AdjustWindowRect
GetActiveWindow
GetWindowRect
CreateAcceleratorTableA
IsZoomed
TranslateAcceleratorA
LoadImageA
SetCursor
SetCapture
MapWindowPoints
ReleaseCapture
MoveWindow
GetClientRect
DefWindowProcA
IsWindowVisible
GetFocus
IsChild
EnumChildWindows
GetClassNameA
EnumDisplaySettingsA
OpenClipboard
GetClipboardData
CloseClipboard
EmptyClipboard
SetClipboardData
ReleaseDC

gdi32

BitBlt
GetObjectType
DeleteObject
CreateCompatibleDC
SelectObject
GetStockObject
DeleteDC
GetObjectA
SetStretchBltMode
SetBrushOrgEx
StretchBlt
GetDIBits
CreateDCA
CreateCompatibleBitmap
CreateDIBSection
SetTextColor
SetBkColor
CreateSolidBrush
GetDeviceCaps
CreateFontA
CreatePen
SetTextAlign
GetTextExtentPoint32A
MoveToEx
TextOutA
SetPixelV
Rectangle
Ellipse
SetROP2
SetBkMode

wsock32

closesocket
WSACleanup
WSAStartup
socket
inet_addr
gethostbyname
htons
connect
ioctlsocket
recvfrom
recv
send
sendto
gethostname
WSAGetLastError

comctl32

InitCommonControlsEx

kernel32

HeapCreate
CreateSemaphoreA
GetLastError
GetDriveTypeA
Beep
Sleep
HeapDestroy
GlobalAlloc
GlobalFree
OpenProcess
TerminateProcess
CloseHandle
GetComputerNameA
CreateFileA
DeviceIoControl
GlobalMemoryStatus
ExitProcess
GetModuleHandleA
HeapFree
HeapAlloc
HeapReAlloc
InitializeCriticalSection
GetCurrentProcess
DuplicateHandle
CreatePipe
GetStdHandle
CreateProcessA
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
WriteFile
PeekNamedPipe
ReadFile
GetFileSize
GetTickCount
GetVersionExA
FreeLibrary
LoadLibraryA
IsBadReadPtr
GetProcAddress
MulDiv
DeleteFileA
FindClose
FindFirstFileA
FindNextFileA
SetFilePointer
GetLocalTime
GlobalLock
GlobalUnlock

advapi32

RegConnectRegistryA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegEnumKeyExA
RegDeleteValueA
RegCreateKeyExA
RegDeleteKeyA
RegEnumValueA

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
ShellExecuteExA

Exports

Exports

enumwindowcallback

Sections

.code
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.flat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f615effb586d7d8635cad45f5a2b8c13

Headers

File Characteristics

Imports

crtdll

user32

gdi32

wsock32

comctl32

kernel32

advapi32

shell32

Exports

Exports

Sections

.code Size: 20KB - Virtual size: 19KB

.text Size: 61KB - Virtual size: 61KB

.rdata Size: 512B - Virtual size: 96B

.data Size: 13KB - Virtual size: 15KB

.flat Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 4KB

.code
Size: 20KB - Virtual size: 19KB

.text
Size: 61KB - Virtual size: 61KB

.rdata
Size: 512B - Virtual size: 96B

.data
Size: 13KB - Virtual size: 15KB

.flat
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 4KB