62e81519e4fb90b13310ee2b01b90447_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

62e81519e4fb90b13310ee2b01b90447_JaffaCakes118
Size

152KB
MD5

62e81519e4fb90b13310ee2b01b90447
SHA1

12fc89846f1e5195b8acfe13b0465a12eb88ce33
SHA256

1f8d5b74cee081f91934ca63ea9a0da277887c417c176e422104056d88140876
SHA512

d4ff8a4a82c9ed4192d2afcd495cfe40230f69695ee575e5fc413c56776a239e80beae04a0c80e373bf0b1164036b9463318a057314c85c59658c4cf30485949
SSDEEP

3072:gJwDaAnfLf3LxzgCo+cveNowO8YvOoUre:mwDD3x7dRN1kK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
62e81519e4fb90b13310ee2b01b90447_JaffaCakes118

Files

62e81519e4fb90b13310ee2b01b90447_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

82b403d5f2b5dfdbd60025910dd11c31

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls
CreateThread
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
lstrlenA
GetShortPathNameA
FreeLibrary
GetProcAddress
GetModuleFileNameA
lstrcatA
GetWindowsDirectoryA
CloseHandle
CreateFileA
GetTempFileNameA
GetTempPathA
SetFileTime
GetFileTime
WideCharToMultiByte
lstrlenW
lstrcpyA
LoadLibraryA
MultiByteToWideChar
RtlUnwind
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
SetEndOfFile
SetFilePointer
IsBadCodePtr
GetOEMCP
GetLastError
LocalFree
HeapFree
HeapReAlloc
HeapAlloc
GetCommandLineA
GetVersion
RaiseException
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
HeapCreate
VirtualFree
ExitProcess
VirtualAlloc
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
HeapSize
SetUnhandledExceptionFilter
SetStdHandle
FlushFileBuffers
ReadFile
GetCPInfo
GetACP

user32

CharNextA
MessageBoxA
GetMessageA

advapi32

RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA

ole32

CoCreateInstance

oleaut32

SysAllocString
SysFreeString
SysAllocStringLen
LoadRegTypeLi
RegisterTypeLi
LoadTypeLi
SysStringLen
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayDestroy
VariantClear

wininet

DeleteUrlCacheEntry

urlmon

URLDownloadToFileA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 120KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

82b403d5f2b5dfdbd60025910dd11c31

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

wininet

urlmon

Exports

Exports

Sections

.text Size: 120KB - Virtual size: 117KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 4KB - Virtual size: 35KB

.rsrc Size: 8KB - Virtual size: 4KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 120KB - Virtual size: 117KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 4KB - Virtual size: 35KB

.rsrc
Size: 8KB - Virtual size: 4KB

.reloc
Size: 8KB - Virtual size: 4KB