78aee8fd91e0e72bb6e9720ddb82e0be_JaffaCakes118

General

Target

78aee8fd91e0e72bb6e9720ddb82e0be_JaffaCakes118
Size

54KB
MD5

78aee8fd91e0e72bb6e9720ddb82e0be
SHA1

f3117656cff2220cc34bfe2ea4ff2a1b4e33d3b6
SHA256

ccba892c9fb3fec536b33d118bfdc9345b1d3d3727b1b0da9f8948aaa1bfb54b
SHA512

a018b736ccdc5191bd7105b1d2bff7f79b32fcdbc314be01aa7863bff2308498e1a3648f0354801138163d9768b864e0bb0e06e9c4373dcde94e4b6a2f334da0
SSDEEP

768:8DNAADjcrf6cYYs+ijq5nG8ks6H3tbACNjf1cO8z/qB3wYDNAADjcrf6cYYs:85dorfZQ+ksZksdC5f78zyxN5dorfZQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
78aee8fd91e0e72bb6e9720ddb82e0be_JaffaCakes118

Files

78aee8fd91e0e72bb6e9720ddb82e0be_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

8b6dcaa575a45461b3905bb33f9b0ac9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

imagehlp

ImageDirectoryEntryToData

kernel32

GetModuleFileNameA
MapViewOfFile
OpenFileMappingA
DisableThreadLibraryCalls
Sleep
HeapAlloc
GetSystemInfo
GetVersionExA
HeapCreate
GetVersion
CreateFileMappingA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
lstrcmpA
EnterCriticalSection
InterlockedDecrement
lstrlenW
WriteFile
ReadFile
GetFileSize
OpenFile
GetSystemDirectoryA
CreateThread
GlobalUnlock
GlobalLock
DebugBreak
HeapFree
UnmapViewOfFile
lstrcpyA
lstrlenA
GetModuleHandleA
GetProcAddress
GetCurrentProcessId
CreateToolhelp32Snapshot
Module32First
Module32Next
CloseHandle
lstrcmpiA
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
InterlockedIncrement
RtlUnwind

user32

FindWindowA
SetWindowsHookExA

advapi32

RegSetValueExA
RegDeleteValueA
RegOpenKeyExA
RegCloseKey

shell32

ShellExecuteA
DragQueryFileA

ole32

ReleaseStgMedium

oleaut32

LoadRegTypeLi
SysFreeString
SysStringLen

atl

ord15
ord32
ord23
ord16
ord21
ord30
ord57
ord18
ord58

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Hp8x6

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 860B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8b6dcaa575a45461b3905bb33f9b0ac9

Headers

File Characteristics

Imports

imagehlp

kernel32

user32

advapi32

shell32

ole32

oleaut32

atl

Exports

Exports

Sections

.text Size: 11KB - Virtual size: 10KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 1024B - Virtual size: 860B

.text
Size: 11KB - Virtual size: 10KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 1024B - Virtual size: 860B