70bd0ccb6884d79d98e83b35ebd523ce_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

70bd0ccb6884d79d98e83b35ebd523ce_JaffaCakes118
Size

124KB
MD5

70bd0ccb6884d79d98e83b35ebd523ce
SHA1

2ed54ebbf04e0f1ae34d091d6a77d6af4bea8279
SHA256

999dd738275ee1836cfb7efdbff8845f6f6d30abaaf7b735b04ee3664825f2f0
SHA512

08d9cd1f4c9ee321313a9fd4bd357f5ad9addf30eb11b7c30e5f42cbd37ca08dba1703627a63d4b26e52170c700638be198ffa1cec0c60b1a5f0ac274d12056c
SSDEEP

3072:dEm8QRlA3aNkRAcTddoNxARag44LJ3Jh9ypXcdJ9XfUfCwhw:dESe/qxJspJip

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
70bd0ccb6884d79d98e83b35ebd523ce_JaffaCakes118

Files

70bd0ccb6884d79d98e83b35ebd523ce_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b060f687462edb4c933fe5696ff0aa82

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateDirectoryW
DeleteFileW
GetTempFileNameW
InterlockedIncrement
InterlockedDecrement
GetCurrentThread
ReadFile
SetFilePointer
GetFileAttributesW
SetFileAttributesW
GetLongPathNameW
HeapAlloc
HeapFree
CancelWaitableTimer
RegisterWaitForSingleObject
SetWaitableTimer
CreateWaitableTimerW
lstrlenW
CancelIo
GetProcessHeap
RaiseException
VirtualAlloc
GetSystemInfo
VirtualQuery
GetTempPathW
DeleteCriticalSection
lstrcmpiW
HeapDestroy
lstrcpynW
lstrlenA
SizeofResource
LoadResource
FindResourceW
GlobalUnlock
GlobalLock
GlobalAlloc
FlushInstructionCache
GetOverlappedResult
EnterCriticalSection
CreateFileW
LeaveCriticalSection
CreateThread
lstrcmpW
SetErrorMode
LoadLibraryW
GetProcAddress
FreeLibrary
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetCurrentThreadId
InterlockedCompareExchange
InterlockedExchange
SetLastError
Sleep
InitializeCriticalSection
ResetEvent
DisableThreadLibraryCalls
CloseHandle
SetEvent
WaitForSingleObject
CreateEventW
GetLastError
InitializeCriticalSectionAndSpinCount
GetTickCount
GetCommandLineA
LoadLibraryA
VirtualProtect

user32

IsChild
GetClientRect
DestroyAcceleratorTable
SetWindowLongW
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
SetWindowPos
GetDC
GetFocus
TranslateMessage
LoadStringW
RegisterWindowMessageW
RedrawWindow
CreateAcceleratorTableW
CharNextW
GetWindowLongW
DestroyWindow
DefWindowProcW
ReleaseDC
GetWindowTextLengthW
wsprintfW
LoadCursorW
GetClassInfoExW
CreateWindowExW
ShowWindow
SetFocus
GetParent
GetWindow
SetWindowTextW
GetWindowTextW
RegisterClassExW
DispatchMessageW

advapi32

ImpersonateLoggedOnUser
CryptAcquireContextW
CryptGetProvParam
CryptReleaseContext
RegDeleteKeyW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
CryptGetKeyParam
CryptGetUserKey
SetServiceStatus
RevertToSelf
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
DuplicateToken
FreeSid
OpenProcessToken
OpenThreadToken
CryptDestroyKey

gdi32

SetWindowExtEx
DeleteMetaFile
CreateRectRgnIndirect
GetDeviceCaps
CreateMetaFileW
SaveDC
SetWindowOrgEx
RestoreDC
CloseMetaFile

ole32

OleInitialize
CreateStreamOnHGlobal
CLSIDFromString
CoUninitialize
CoTaskMemFree
CoImpersonateClient
CoRevertToSelf
CoDisconnectObject
CoRevokeClassObject
CoInitializeEx
CoCreateInstance
CoTaskMemAlloc

msvcrt

realloc
wcschr
memcpy
_vsnwprintf
_wcsnicmp
_adjust_fdiv
_initterm
free
_except_handler3
__CxxFrameHandler
malloc

msvcp60

??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??Ostd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z

Sections

.text
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b060f687462edb4c933fe5696ff0aa82

Headers

File Characteristics

Imports

kernel32

user32

advapi32

gdi32

ole32

msvcrt

msvcp60

Sections

.text Size: 51KB - Virtual size: 51KB

.rdata Size: 39KB - Virtual size: 38KB

.data Size: 1024B - Virtual size: 34KB

.rsrc Size: 28KB - Virtual size: 28KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 51KB - Virtual size: 51KB

.rdata
Size: 39KB - Virtual size: 38KB

.data
Size: 1024B - Virtual size: 34KB

.rsrc
Size: 28KB - Virtual size: 28KB

.reloc
Size: 4KB - Virtual size: 3KB