6ee483d2ecbb722454ba5bc0bc48c92d_JaffaCakes118

General

Target

6ee483d2ecbb722454ba5bc0bc48c92d_JaffaCakes118
Size

17KB
MD5

6ee483d2ecbb722454ba5bc0bc48c92d
SHA1

c3ad67b7900507a9d966304abd5dc2952bfc573a
SHA256

4a6628e60fecfa2e955c99cd97a76087c94cc5ad2b890c45fdf13716de308e83
SHA512

059a72be671d8a35398d66c890a062da96ee1c8f1d3ac712ddcf1435f4e79d35f6be0337e31c007f8a58c23df8ac19a8b6fe9a2f071a74cd59bba628bab3a5d5
SSDEEP

192:ifMpdBfRq0VlR3TqUC6VLm+ohl8Kt0Ffk+pMwjER2+jNYg9:iUNo0Vbqk6+ohlrt0fkZw4R2+xz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6ee483d2ecbb722454ba5bc0bc48c92d_JaffaCakes118

Files

6ee483d2ecbb722454ba5bc0bc48c92d_JaffaCakes118
.dll windows:4 windows x86 arch:x86

d1028b4a946b58e300f4d47e94a70545

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OpenProcess
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
LoadLibraryA
WriteProcessMemory
VirtualAllocEx
FindClose
FindNextFileA
lstrcpynA
lstrcpyA
lstrcmpA
FindFirstFileA
VirtualProtectEx
Module32Next
Module32First
ReleaseMutex
GetModuleFileNameA
CreateMutexA
WinExec
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Process32First
lstrcmpiA
Process32Next
GetSystemDirectoryA
lstrlenA
GetModuleHandleA
GetProcAddress
WriteFile
GetTempPathA
GetTickCount
GetPrivateProfileIntA
Sleep
CreateThread
CloseHandle
GetPrivateProfileStringA
GetLastError
ReadFile
GetCurrentProcessId

user32

OpenWindowStationA
SetProcessWindowStation
OpenDesktopA
SetThreadDesktop
wsprintfA
GetForegroundWindow
GetClassNameA
GetWindowTextA

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

shlwapi

StrStrIA

msvcrt

strstr
atoi
strcat
strlen
strncat
memset
strncpy
memcpy
_purecall
strcmp
??3@YAXPAX@Z
strcpy
??2@YAPAXI@Z

wininet

InternetCloseHandle

Sections

.bss
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 1024B - Virtual size: 532B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d1028b4a946b58e300f4d47e94a70545

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

msvcrt

wininet

Sections

.bss Size: - Virtual size: 12KB

.data Size: 13KB - Virtual size: 13KB

.shared Size: 1024B - Virtual size: 532B

.reloc Size: 2KB - Virtual size: 1KB

.bss
Size: - Virtual size: 12KB

.data
Size: 13KB - Virtual size: 13KB

.shared
Size: 1024B - Virtual size: 532B

.reloc
Size: 2KB - Virtual size: 1KB