6a97aefcd1115a422530152c6b8bf811_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6a97aefcd1115a422530152c6b8bf811_JaffaCakes118
Size

35KB
MD5

6a97aefcd1115a422530152c6b8bf811
SHA1

8a414d47b66e0760cc3c7d647d2ac6e5430b3ad9
SHA256

e2b9f97221c82fcb96200fa705e4c484dd0508c4dc30a4e2775189413517a3f5
SHA512

d0f73719ff280bcecb60bda99db739a5f394f56cc0e6bdf7ddc5c620245d0417f30af6d09a063d5121a52bc8f8157bca584e509b22c53571dfe5a99838f5ef81
SSDEEP

768:Hz1vzqq8NNg63coxHn8MNhmDZ9qfLn1ZB:Hz1vN8NNg6cfZwr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6a97aefcd1115a422530152c6b8bf811_JaffaCakes118

Files

6a97aefcd1115a422530152c6b8bf811_JaffaCakes118
.dll windows:4 windows x86 arch:x86

e634f3b0881558b1dfaf618b40e8293e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ExitProcess
ResumeThread
WriteProcessMemory
VirtualProtectEx
OpenProcess
GetModuleFileNameA
GetProcAddress
ReadProcessMemory
GetCurrentProcess
GetModuleHandleA
GetPrivateProfileStringA
CloseHandle
CreateRemoteThread
VirtualAllocEx
lstrlenA
ReadFile
CreateFileA
WideCharToMultiByte
MultiByteToWideChar
CreateProcessA
GetSystemDirectoryA
TerminateProcess
DisableThreadLibraryCalls
SetFilePointer
WriteFile
DeleteFileA
InitializeCriticalSection
VirtualProtect
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
SetThreadContext
OpenThread
SetUnhandledExceptionFilter
GetTickCount
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetCommandLineA
IsBadReadPtr
TerminateThread
CreateThread
GetCurrentProcessId
CreateMutexA
GetCurrentThreadId
GetLastError

user32

UnhookWindowsHookEx
CallNextHookEx
GetWindowThreadProcessId
SetWindowsHookExA
GetKeyState
FindWindowA

imagehlp

ImageLoad
ImageUnload

shlwapi

PathFileExistsA

msvcrt

_initterm
malloc
_strupr
_adjust_fdiv
_stricmp
_strlwr
_strnicmp
free
wcslen
strcmp
fopen
fread
strcat
sprintf
strcpy
??2@YAPAXI@Z
memcpy
strrchr
memset
rand
srand
strlen
atoi
??3@YAXPAX@Z
strncpy
strchr
strstr
fclose

wininet

InternetCloseHandle
InternetReadFile

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e634f3b0881558b1dfaf618b40e8293e

Headers

File Characteristics

Imports

kernel32

user32

imagehlp

shlwapi

msvcrt

wininet

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 4KB

sdata Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 4KB

sdata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB