825756c12e340d2bc4624bfb23265233_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

825756c12e340d2bc4624bfb23265233_JaffaCakes118
Size

160KB
MD5

825756c12e340d2bc4624bfb23265233
SHA1

7dcd289fe817709f1789b20ea9c868d239629ccb
SHA256

a2c7a56dee0d9ee85a7daced5c06caeec16fdfd6279b6f13b53848f6d62ec1a0
SHA512

a6f81c7a67fbd253c21ba0201331a78d3f2763b29ae3e1fc2aa90bf068a79a0b0a639506439f71e107fc2062d85a784e22efa59cabd31f8234afdd92281e556c
SSDEEP

3072:SjrSjbigXaPkBSbPf85Nd74N1dZitTCG4ofqQVYA:Ura7XAAqPf8taeTkOYA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
825756c12e340d2bc4624bfb23265233_JaffaCakes118

Files

825756c12e340d2bc4624bfb23265233_JaffaCakes118
.dll windows:4 windows x86 arch:x86

ab6c2848f4ff41a23a377e483fb3899c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
HeapFree
CopyFileA
SetLastError
EnterCriticalSection
OpenEventA
WaitForSingleObject
CreateEventA
WriteFile
GetLastError
GetComputerNameA
InterlockedIncrement
CreateDirectoryA
GlobalFree
CreateFileA
GetVolumeInformationA
GlobalAlloc
HeapAlloc
GetModuleFileNameA
LocalFree
InterlockedDecrement
GetTickCount
ReadProcessMemory
CreateMutexW
ExitProcess
GetCurrentProcess
OpenFileMappingA
GetProcAddress
InterlockedCompareExchange
LeaveCriticalSection
CloseHandle
Sleep
GetModuleHandleA
WriteProcessMemory
UnmapViewOfFile
MapViewOfFile
TerminateProcess
GetCommandLineA
CreateProcessA
GetProcessHeap
CreateFileMappingA

ole32

CoInitialize
CoCreateGuid
OleCreate
CoTaskMemAlloc
CoSetProxyBlanket
CoUninitialize
CoCreateInstance
OleSetContainedObject

user32

SetWindowsHookExA
CreateWindowExA
GetCursorPos
PostQuitMessage
GetSystemMetrics
ScreenToClient
TranslateMessage
SetTimer
GetWindow
DefWindowProcA
GetParent
GetWindowThreadProcessId
UnhookWindowsHookEx
FindWindowA
SendMessageA
KillTimer
DispatchMessageA
ClientToScreen
GetMessageA
PeekMessageA
DestroyWindow
GetWindowLongA
GetClassNameA
RegisterWindowMessageA
SetWindowLongA

oleaut32

SysStringLen
SysAllocStringLen
SysFreeString
SysAllocString

shlwapi

StrStrIW
UrlUnescapeW

advapi32

GetUserNameA
RegDeleteValueA
SetTokenInformation
RegOpenKeyExA
RegQueryValueExA
DuplicateTokenEx
OpenProcessToken
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegCloseKey

shell32

SHGetFolderPathA

Exports

Exports

SecurityUserNotifier

Sections

.text
Size: 128KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

foj
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ab6c2848f4ff41a23a377e483fb3899c

Headers

File Characteristics

Imports

kernel32

ole32

user32

oleaut32

shlwapi

advapi32

shell32

Exports

Exports

Sections

.text Size: 128KB - Virtual size: 125KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 976B

foj Size: 4KB - Virtual size: 12B

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 128KB - Virtual size: 125KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 976B

foj
Size: 4KB - Virtual size: 12B

.reloc
Size: 8KB - Virtual size: 6KB