68f654a8dbbc84ceda93d9e78c5ada18_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

68f654a8dbbc84ceda93d9e78c5ada18_JaffaCakes118
Size

150KB
MD5

68f654a8dbbc84ceda93d9e78c5ada18
SHA1

27f3b73b45b11b62683cb5090626873d227ff756
SHA256

293c8db0101859e2b5b995758d6e960d3183c6d6d695f6b10a5148a26b6a723d
SHA512

ed9ad6e238ea8adcec7a447ff97aa0f1158c3c7638391a097d5ee27bda781b51f42d19f9d8d5d3903843edf1844533e58a1d50660b26caf31fab1f488e9d664a
SSDEEP

3072:rB8FTg22TtkejDey5M9IbPEb5UjVNTBftra:rI2TSejKy+qj15NTBl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
68f654a8dbbc84ceda93d9e78c5ada18_JaffaCakes118

Files

68f654a8dbbc84ceda93d9e78c5ada18_JaffaCakes118
.dll windows:4 windows x86 arch:x86

9a3aa14ab8de4366b6b894f14f205de0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetExitCodeThread
GetFileSize
GetLastError
GetLocaleInfoA
GetLogicalDriveStringsA
GetModuleFileNameW
GetModuleHandleA
GetOverlappedResult
GetProcAddress
GetStdHandle
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetTimeFormatA
GetVersionExA
GetVolumeInformationA
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LocalAlloc
LocalFree
LockFileEx
MapViewOfFile
MultiByteToWideChar
OpenFileMappingA
OpenMutexA
OpenProcess
OpenThread
GetEnvironmentVariableA
Process32First
Process32Next
ReadFile
ReadFileEx
ReadProcessMemory
ReleaseMutex
ResumeThread
SetEndOfFile
SetEvent
SetFilePointer
SetLastError
SetNamedPipeHandleState
Sleep
SuspendThread
Thread32First
Thread32Next
UnlockFileEx
UnmapViewOfFile
VirtualAlloc
VirtualAllocEx
VirtualFree
VirtualFreeEx
VirtualProtect
VirtualProtectEx
WaitForSingleObject
WaitForSingleObjectEx
WaitNamedPipeA
WideCharToMultiByte
WriteConsoleA
WriteFile
WriteFileEx
WriteProcessMemory
lstrcatA
lstrcmpiA
lstrcpyA
lstrlenA
lstrlenW
GetDriveTypeA
GetDateFormatA
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetComputerNameA
FreeConsole
ExitProcess
EnterCriticalSection
DisconnectNamedPipe
DeleteCriticalSection
CreateToolhelp32Snapshot
CreateThread
CreateRemoteThread
CreateNamedPipeA
CreateMutexA
CreateFileMappingA
CreateFileA
CreateEventA
ConnectNamedPipe
CompareStringW
CloseHandle
PeekNamedPipe
AllocConsole

advapi32

RegQueryValueExA
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetUserNameA
GetUserNameW
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
AdjustTokenPrivileges
RegQueryInfoKeyA

user32

LoadCursorA
GetWindowRect
GetWindowDC
GetKeyboardState
ToUnicode
ExitWindowsEx
DrawTextA
DrawIcon
CharUpperBuffW
CharUpperBuffA
wsprintfA
GetIconInfo
ReleaseDC

gdi32

StretchBlt
SetTextColor
SetStretchBltMode
SetBkColor
SelectObject
GdiFlush
DeleteObject
DeleteDC
CreateCompatibleDC
CreateDIBSection

ole32

CreateStreamOnHGlobal

Sections

.text
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9a3aa14ab8de4366b6b894f14f205de0

Headers

File Characteristics

Imports

kernel32

advapi32

user32

gdi32

ole32

Sections

.text Size: 109KB - Virtual size: 108KB

.rdata Size: 17KB - Virtual size: 16KB

.data Size: 20KB - Virtual size: 21KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 109KB - Virtual size: 108KB

.rdata
Size: 17KB - Virtual size: 16KB

.data
Size: 20KB - Virtual size: 21KB

.reloc
Size: 3KB - Virtual size: 2KB