64165282a2f8b1be017e7452046be5ef_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

64165282a2f8b1be017e7452046be5ef_JaffaCakes118
Size

79KB
MD5

64165282a2f8b1be017e7452046be5ef
SHA1

9a806cdb7b8bdff4c3aa4ced57d378acf9eead78
SHA256

07f5e54268076fb2288d54f225ea905b47b7509c92adaff6e0d2693bbf1b732d
SHA512

a2407cce2b267067a14e32ef6f5b3c7c42d28d4680d3e5c4d3c768320d79f010cd505b0b304cb61a2528a356126fbd1533f3a80ddd23638c013c1992f466fe3c
SSDEEP

1536:HN6PG2ep2Nc/WF3mP0MieKHNQwQKEwrIK1dnSY0wq4:HuepSDMieKHNQwiHK1dnSW/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64165282a2f8b1be017e7452046be5ef_JaffaCakes118

Files

64165282a2f8b1be017e7452046be5ef_JaffaCakes118
.dll windows:4 windows x86 arch:x86

9047c16356e93fb89698dee51e1b5e15

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileSectionA
GetFileSize
GetProcAddress
GetSystemDirectoryA
GetSystemTime
GetTempPathA
GetTickCount
GlobalLock
GlobalUnlock
GetCurrentProcessId
GetCurrentThreadId
HeapDestroy
HeapFree
LoadLibraryA
MoveFileA
OpenEventA
ResetEvent
ResumeThread
HeapCreate
SetErrorMode
SetEvent
SetFilePointer
Sleep
SystemTimeToFileTime
HeapAlloc
SetEndOfFile
WritePrivateProfileSectionA
CreateMutexA
GetWindowsDirectoryA
CreateProcessA
GetEnvironmentVariableA
FormatMessageA
GetLocaleInfoA
ReadFile
ReleaseMutex
CreateThread
CreatePipe
DuplicateHandle
GetCurrentProcess
GetExitCodeProcess
PeekNamedPipe
TerminateProcess
GetCommModemStatus
GetLocalTime
GetVersion
CloseHandle
FreeLibrary
DeleteFileA
CopyFileA
CreateFileA
CreateEventA
WaitForSingleObject
WriteFile
GetFileType

user32

IsClipboardFormatAvailable
KillTimer
MsgWaitForMultipleObjects
OpenClipboard
PeekMessageA
GetWindowThreadProcessId
PostQuitMessage
PostThreadMessageA
RegisterClassA
RegisterWindowMessageA
SendMessageA
SetWindowsHookExA
ShowWindow
GetClipboardData
GetParent
GetWindowTextA
CharToOemBuffA
OemToCharBuffA
PostMessageA
EnumWindows
GetClassLongA
GetActiveWindow
FindWindowA
DispatchMessageA
DestroyWindow
DefWindowProcA
CreateWindowExA
CloseClipboard
GetMessageTime
SetTimer
UnhookWindowsHookEx
GetClassNameA
UnregisterClassA
CallNextHookEx

advapi32

RegCreateKeyExA
RegDeleteValueA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetUserNameA

wsock32

send
WSAGetLastError
accept
bind
closesocket
connect
getsockname
ioctlsocket
listen
recv
WSACancelAsyncRequest
shutdown
inet_ntoa
inet_addr
gethostname
WSAAsyncSelect
WSAAsyncGetHostByName
socket
WSAStartup
WSACleanup

rasapi32

RasDialA
RasHangUpA

shell32

ShellExecuteA

Exports

Exports

init

Sections

.text
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 840B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9047c16356e93fb89698dee51e1b5e15

Headers

File Characteristics

Imports

kernel32

user32

advapi32

wsock32

rasapi32

shell32

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 42KB

.bss Size: - Virtual size: 840B

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 12KB - Virtual size: 9KB

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 44KB - Virtual size: 42KB

.bss
Size: - Virtual size: 840B

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 12KB - Virtual size: 9KB

.reloc
Size: 4KB - Virtual size: 2KB