4a42617567e2c736657c6c6cecc3fe60_JaffaCakes118

General

Target

4a42617567e2c736657c6c6cecc3fe60_JaffaCakes118
Size

248KB
MD5

4a42617567e2c736657c6c6cecc3fe60
SHA1

cf6b63ad75aa56bb522c0a9917f6d3e6fa963f42
SHA256

ea78d4a0da1e963c355d36264516c3d534dd5bdb96b8871f2bb3cb00ee9621ff
SHA512

53190f4a21b7dfb62a5627689467d4994cd0413e2ee3ae5815999f77e7cda63e4713cb1324824dcd666656b5da3c29bf7cce0ffd1b4ccf80e9b0e8fd16c1a41c
SSDEEP

768:kLIeDE6KGFgigFkCGqMicSDuOqvzvDttwEw0bqm2Kp/VFNABBQARQklXMv3kT:ksUEJGFmErnp/VFNABBQAR1hT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4a42617567e2c736657c6c6cecc3fe60_JaffaCakes118

Files

4a42617567e2c736657c6c6cecc3fe60_JaffaCakes118
.dll windows:4 windows x86 arch:x86

11ba97384d8fd73c79b8db14dbacf5ab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

RtlUnwind
RtlZeroMemory
_snprintf
_strupr
ZwQuerySystemInformation
memcmp
memcpy
strlen
strstr

kernel32

GetCurrentProcessId
lstrcpynA
WriteFile
WideCharToMultiByte
VirtualProtectEx
VirtualProtect
VirtualFree
CloseHandle
CreateThread
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileStringA
GetProcAddress
GetSystemDirectoryA
GlobalAlloc
GlobalFree
LoadLibraryA
Sleep
TerminateThread
WaitForSingleObject
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrlenA
ExitProcess
IsBadReadPtr
WritePrivateProfileStringA
CreateFileA
CreateFileMappingA
CreateProcessA
DeleteFileA
VirtualAlloc
GetExitCodeThread
GetFileSize
GetLastError
GetStartupInfoA
GetTempFileNameA
GetTempPathA
MapViewOfFile
MoveFileExA
OpenThread
ReadFile
SuspendThread
UnmapViewOfFile

user32

wsprintfA
UnhookWindowsHookEx
SetTimer
SendMessageA
RegisterWindowMessageA
KillTimer
GetWindowThreadProcessId

Sections

.text
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 12B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 204KB - Virtual size: 202KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

11ba97384d8fd73c79b8db14dbacf5ab

Headers

File Characteristics

Imports

ntdll

kernel32

user32

Sections

.text Size: 32KB - Virtual size: 28KB

.bss Size: - Virtual size: 12B

.rdata Size: 4KB - Virtual size: 1KB

.data Size: 204KB - Virtual size: 202KB

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 32KB - Virtual size: 28KB

.bss
Size: - Virtual size: 12B

.rdata
Size: 4KB - Virtual size: 1KB

.data
Size: 204KB - Virtual size: 202KB

.reloc
Size: 4KB - Virtual size: 1KB