74573e1ee3270f8c0d602569e02708e2_JaffaCakes118

General

Target

74573e1ee3270f8c0d602569e02708e2_JaffaCakes118
Size

13KB
MD5

74573e1ee3270f8c0d602569e02708e2
SHA1

e98e35f1cbace88febd72c2823054a801c1a5c20
SHA256

6ce13313be1d71be6765fe1c13be5e814d18c17f0c6f60b1a5e56ff08630474b
SHA512

d5131b6de8307c26a1752650393cef9df36fb94ab328d47ea0517a5ec2336c8f6dec6e0314945e21ea17b38b4c8a2c931a70652f49f945f312ed189925bd04ea
SSDEEP

192:YMPNv6Q3dUMWUlqG2idgph220M+7VaXKiXcEnTDzVFPD:YYVdUMWUlqEdgirP0cE3TP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
74573e1ee3270f8c0d602569e02708e2_JaffaCakes118

Files

74573e1ee3270f8c0d602569e02708e2_JaffaCakes118
.dll windows:4 windows x86 arch:x86

4f506234391aad489c99b2abab39fe25

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WriteProcessMemory
VirtualAllocEx
OpenProcess
GetProcAddress
GetModuleHandleA
DeleteFileA
CreateFileA
WriteFile
OpenEventA
Sleep
GetFileSize
ReadFile
GetModuleFileNameA
VirtualProtectEx
VirtualFreeEx
GlobalFree
GlobalLock
GlobalAlloc
GetCurrentProcess
CopyFileA
OutputDebugStringA
CreateEventA
SetThreadPriority
CreateThread
GetComputerNameA
TerminateThread
IsBadReadPtr
CreateRemoteThread
GetCurrentThreadId
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
VirtualFree
ReadProcessMemory
VirtualAlloc

user32

UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
GetThreadDesktop
GetDC
wsprintfA
GetInputState
PostThreadMessageA
GetMessageA

advapi32

RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegSetValueExA

wininet

InternetOpenA
InternetOpenUrlA
InternetCloseHandle

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdata
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 812B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4f506234391aad489c99b2abab39fe25

Headers

File Characteristics

Imports

kernel32

user32

advapi32

wininet

Sections

.text Size: 11KB - Virtual size: 10KB

sdata Size: 512B - Virtual size: 260B

.reloc Size: 1024B - Virtual size: 812B

.text
Size: 11KB - Virtual size: 10KB

sdata
Size: 512B - Virtual size: 260B

.reloc
Size: 1024B - Virtual size: 812B