72a72a46d85474c821a1af8b24e10233_JaffaCakes118

General

Target

72a72a46d85474c821a1af8b24e10233_JaffaCakes118
Size

25KB
MD5

72a72a46d85474c821a1af8b24e10233
SHA1

14ea57be9a89d1f48a03a52c4d13807edc703430
SHA256

a6c4ba555c52488341508daaf436b00b011a2c3c61df973c5d92d9d5f3c1b16b
SHA512

9b7889f43f2517ce503544755ef1bed9bc9d52e085b9fe645169e29e62e0df3625744c6fb54ae35e543f0d297f63cd9d96d10bebae096c2833939891656c9d34
SSDEEP

192:kM3LDryFd2sKpTw3pubVmnNCIGaOHHTISs2unJZKOJPxvKNnFDrruatydxDNz:k2LCsvTVWxeg2w3O15rptyP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
72a72a46d85474c821a1af8b24e10233_JaffaCakes118

Files

72a72a46d85474c821a1af8b24e10233_JaffaCakes118
.dll windows:4 windows x86 arch:x86

4442d33967c2fc6ab64ff599b003e6b9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
CreateMutexA
OpenProcess
GetCurrentProcessId
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetProcAddress
GetModuleHandleA
FindClose
FindNextFileA
lstrcpynA
lstrcpyA
lstrcmpA
FindFirstFileA
VirtualProtectEx
LoadLibraryA
Module32Next
CreateToolhelp32Snapshot
ReadFile
GetModuleFileNameA
ReleaseMutex
WinExec
TerminateProcess
CreateThread
Sleep
GetCurrentProcess
Thread32Next
TerminateThread
GetThreadPriority
OpenThread
Thread32First
IsBadReadPtr
Process32First
lstrcmpiA
Process32Next
lstrlenA
CreateFileA
WriteFile
CloseHandle
GetTempPathA
GetSystemDirectoryA
Module32First

user32

GetWindowThreadProcessId
EnumWindows
SetThreadDesktop
OpenDesktopA
SetProcessWindowStation
OpenWindowStationA

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

shlwapi

StrStrIA

wininet

InternetCloseHandle

msvcrt

??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
strcmp
_purecall
isprint
strstr
strncat
strcat
memset
strcpy
sprintf
_itoa

Sections

.bss
Size: - Virtual size: 9.0MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4442d33967c2fc6ab64ff599b003e6b9

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

wininet

msvcrt

Sections

.bss Size: - Virtual size: 9.0MB

.data Size: 15KB - Virtual size: 14KB

.reloc Size: 9KB - Virtual size: 8KB

.bss
Size: - Virtual size: 9.0MB

.data
Size: 15KB - Virtual size: 14KB

.reloc
Size: 9KB - Virtual size: 8KB