7668cd3322d923806e50004c0e324c8b_JaffaCakes118

General

Target

7668cd3322d923806e50004c0e324c8b_JaffaCakes118
Size

65KB
MD5

7668cd3322d923806e50004c0e324c8b
SHA1

6a3dde2836148f79f9f06326cc9119c4ae3105dc
SHA256

b68e9d16586926a8c9fa2e1c972eb1d71cfe0c4deb722be2ce42c88d30df8b8e
SHA512

5dc76c4ea0243b325af1b3ac40c52e267f8d5d5993fa007f7e6d23c7626ee05b0e09e647613e8263c2493353c4c4a4952d5940977ae36a63c3c37a2b40d923f1
SSDEEP

768:5MwLsN28g2vGL+xZcXCd/vc0AA5Ld1vTbcKVMNhSeqbWUwnuREN:5M/g2vGqb9c6HNHcKVMNhSOUwuREN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7668cd3322d923806e50004c0e324c8b_JaffaCakes118

Files

7668cd3322d923806e50004c0e324c8b_JaffaCakes118
.dll windows:4 windows x86 arch:x86

9dc2501ca0ef52cc2b97f12369a881de

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcatA
lstrcpyA
OpenProcess
GetProcAddress
GetModuleHandleA
GetVersionExA
DeleteFileA
Process32Next
Process32First
CreateToolhelp32Snapshot
Sleep
ExitThread
TerminateThread
WaitForMultipleObjects
CreateMailslotA
GetModuleFileNameA
GetLastError
WaitForSingleObject
IsBadReadPtr
ReadFile
lstrlenA
GetSystemDirectoryA
CreateDirectoryA
GetTickCount
SetFilePointer
GetTempFileNameA
FindNextFileA
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
LoadLibraryA
ReleaseMutex
GetModuleHandleW
CreateEventA
CreateMutexW
MultiByteToWideChar
CreateThread
FindClose
FindFirstFileA
lstrcmpA
ResetEvent
CompareStringA
OpenEventA
GetFileAttributesA
GetCurrentProcessId
GetWindowsDirectoryA
GetCurrentThreadId
CreateFileA
WriteFile
CloseHandle
SetEndOfFile
SetEvent

user32

wsprintfA

advapi32

CryptEncrypt
CryptDestroyHash
CryptDestroyKey
CryptReleaseContext
RegNotifyChangeKeyValue
RegCreateKeyExA
RegSetValueExA
CreateProcessAsUserA
InitializeSecurityDescriptor
CryptHashData
CryptCreateHash
RegOpenCurrentUser
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RevertToSelf
CryptAcquireContextA
CryptDecrypt
CryptDeriveKey

iphlpapi

GetAdaptersInfo

shell32

SHGetFolderPathA

Sections

.text
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9dc2501ca0ef52cc2b97f12369a881de

Headers

File Characteristics

Imports

kernel32

user32

advapi32

iphlpapi

shell32

Sections

.text Size: 54KB - Virtual size: 54KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 54KB - Virtual size: 54KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB