73cdcb176a00c1cb732c82e243f8a7be_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

73cdcb176a00c1cb732c82e243f8a7be_JaffaCakes118
Size

352KB
MD5

73cdcb176a00c1cb732c82e243f8a7be
SHA1

8aa05e264d5c8448e9f82c1ed384bd825610b030
SHA256

7cc9da10949388788c52c5b80fe7bc9acc283844e5f03baa65e7aaf0760acfec
SHA512

89dd3501e42bb2a7946321d46f5fbce09ba487ef22266e26e0e584e5eacde17a13f60c7073e10259597fbb65dbf23d4fba6f6b0ebb5d1046b072db2deeb7a14b
SSDEEP

6144:RgiqK6aHlkIZPbx2kkxKlntMzoXo7i0GoKWPk58bVumDlOrNiYvQMe5P:SiqnaWkPbxbk4lnHY7imnPk58umDlOr/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
73cdcb176a00c1cb732c82e243f8a7be_JaffaCakes118

Files

73cdcb176a00c1cb732c82e243f8a7be_JaffaCakes118
.dll windows:6 windows x86 arch:x86

4d6c1883b05bafd2bc517141759b36c9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

PathAppendW
PathFileExistsW

advapi32

RegSetKeyValueW
ConvertSidToStringSidW
GetUserNameW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegCloseKey
RegCreateKeyExW
RegDeleteKeyExW
RegOpenKeyExW
RegSetValueExW
CryptDestroyHash
CryptAcquireContextW
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
LookupAccountNameW

kernel32

CreateFileMappingW
HeapAlloc
GetFileSize
GetCommandLineA
CreateFileW
DeleteFileW
GetTempFileNameW
GetVolumeInformationW
WriteFile
GetTempPathW
CloseHandle
GetLastError
MapViewOfFile
HeapFree
GetProcessHeap
HeapValidate
WaitForSingleObject
CreateProcessW
GetVersion
GetTickCount
GetSystemDirectoryW
GetSystemWindowsDirectoryW
GetModuleHandleA
GetProcAddress
lstrcmpA
lstrcpyW
lstrlenA
lstrlenW
AttachConsole
LoadLibraryW
LocalFree
UnmapViewOfFile

user32

wsprintfW
wvsprintfA

shell32

SHGetSpecialFolderPathW
ShellExecuteExW

ole32

CoInitializeEx

Exports

Exports

ReflectiveLoader

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 580B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.data1
Size: 318KB - Virtual size: 320KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4d6c1883b05bafd2bc517141759b36c9

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

advapi32

kernel32

user32

shell32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 12KB - Virtual size: 17KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1024B - Virtual size: 580B

.data1 Size: 318KB - Virtual size: 320KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 12KB - Virtual size: 17KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1024B - Virtual size: 580B

.data1
Size: 318KB - Virtual size: 320KB