68199d49d0e5570de2bda118bdd0d084_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

68199d49d0e5570de2bda118bdd0d084_JaffaCakes118
Size

30KB
MD5

68199d49d0e5570de2bda118bdd0d084
SHA1

1dad3302347437b4d98395d749bcea227e7bf9ee
SHA256

397eb03ec5379d3ea5e2b139c7ffc6da4954cecefb06df02680955fe067e827a
SHA512

7acf7cb3afb87578297d3d0a077397195ecc931fd0a09bd272c23b9191a9d92f5cd9146e89c38ed9c3c38a397fd34e49536a329a57512dbfec3976393645e87f
SSDEEP

384:tXsRwAyXD/KZJx5YWmCG4bAShUGtHdBXprXJLOOYydLP59UOKnzDBak1f:hsRwAE8x5YtCrUyHn1JCOYdRz1aef

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
68199d49d0e5570de2bda118bdd0d084_JaffaCakes118

Files

68199d49d0e5570de2bda118bdd0d084_JaffaCakes118
.dll windows:4 windows x86 arch:x86

4afab062de557a9d2b44a824fbaeffe5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GlobalFree
GlobalUnlock
WriteFile
GlobalLock
GlobalAlloc
GetTempPathA
Process32Next
Process32First
CreateToolhelp32Snapshot
WritePrivateProfileStringA
CreateThread
GetPrivateProfileIntA
GetPrivateProfileStringA
WideCharToMultiByte
DeleteFileA
GetModuleHandleA
SetFileAttributesA
SizeofResource
LockResource
LoadResource
FindResourceA
CopyFileA
GetModuleFileNameA
VirtualProtect
GetCurrentProcessId
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
GetLastError
CreateMutexA
CreateFileA
ReadFile
GetFileSize
CloseHandle
GetTickCount
lstrcmpiA
lstrcpynA
lstrlenA
lstrcpyA
lstrcmpA
Sleep
ExitProcess
GetSystemDirectoryA
lstrcatA
LoadLibraryA
GetProcAddress
FreeLibrary
IsBadReadPtr
OutputDebugStringA

user32

PostThreadMessageA
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
EnumWindows
GetWindowTextA
IsWindowVisible
ReleaseDC
GetDC
IsRectEmpty
GetWindowThreadProcessId
FindWindowExA
FindWindowA
PrintWindow
GetWindowInfo
SetForegroundWindow
ShowWindow
GetActiveWindow
IsIconic
GetSystemMetrics

gdi32

CreateCompatibleDC
GetDIBits
RealizePalette
SelectPalette
GetStockObject
GetObjectA
DeleteDC
GetDeviceCaps
CreateDCA
DeleteObject
BitBlt
SelectObject
CreateCompatibleBitmap

wininet

InternetReadFile
HttpSendRequestA
InternetQueryDataAvailable
InternetConnectA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
InternetOpenA
InternetCloseHandle
HttpOpenRequestA

msvcrt

??2@YAPAXI@Z
free
malloc
atoi
wcscmp
strstr
memmove
wcscpy
_beginthread

gdiplus

GdiplusShutdown
GdipSaveImageToFile
GdipLoadImageFromFile
GdipAlloc
GdipGetImageEncodersSize
GdipFree
GdipDisposeImage
GdipCloneImage
GdipGetImageEncoders
GdiplusStartup

Exports

Exports

DeleteSelf
wdof
wdon

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4afab062de557a9d2b44a824fbaeffe5

Headers

File Characteristics

Imports

kernel32

user32

gdi32

wininet

msvcrt

gdiplus

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 16KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 2KB - Virtual size: 18KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 16KB - Virtual size: 16KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 2KB - Virtual size: 18KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 2KB - Virtual size: 2KB