79078dba59300faed5e2e72b1820da47_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

79078dba59300faed5e2e72b1820da47_JaffaCakes118
Size

224KB
MD5

79078dba59300faed5e2e72b1820da47
SHA1

9865946b12f4b1e4c741236bac4fc37a94ff5943
SHA256

00299e1649a5ae41e7f49aff1d2cc3c00083d807da5b7924dcac4ee78ccd6758
SHA512

353800db3a1c9d552734d80b6cc189d821c5b51b3e0b024a7bd0f427a4f9beabc087014e35b16ec6bec32c871019673e4fcd426a292e4e5932e6b4968fe8d834
SSDEEP

1536:wMMbyQFs9TBMQbJBOq0NX1t73fZ5GstYWifg5xxuKTWJS3wcPSe2mgmV9lkkGEoq:wMGyQqRbJBOZNXXzXGs6ojHoPi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
79078dba59300faed5e2e72b1820da47_JaffaCakes118

Files

79078dba59300faed5e2e72b1820da47_JaffaCakes118
.dll windows:4 windows x86 arch:x86

71b372d4d0b7db919d422740879bf630

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetWindowThreadProcessId
SetWindowsHookExA
RegisterWindowMessageA
SendMessageA
UnhookWindowsHookEx
CallNextHookEx

kernel32

GetModuleHandleA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
CloseHandle
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetCurrentThread
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
IsBadWritePtr
IsBadReadPtr
HeapValidate
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
HeapFree
VirtualFree
SetConsoleCtrlHandler
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
UnhandledExceptionFilter
RtlUnwind
HeapAlloc
HeapReAlloc
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetFilePointer
Sleep
SetStdHandle
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
FlushFileBuffers

Exports

Exports

GetWindowTextRemote

Sections

.text
Size: 172KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 4KB - Virtual size: 577B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

71b372d4d0b7db919d422740879bf630

Headers

File Characteristics

Imports

user32

kernel32

Exports

Exports

Sections

.text Size: 172KB - Virtual size: 168KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 20KB - Virtual size: 25KB

.idata Size: 4KB - Virtual size: 2KB

.shared Size: 4KB - Virtual size: 577B

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 172KB - Virtual size: 168KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 20KB - Virtual size: 25KB

.idata
Size: 4KB - Virtual size: 2KB

.shared
Size: 4KB - Virtual size: 577B

.reloc
Size: 8KB - Virtual size: 6KB