835e854d90e709e8c6e083e807cc561d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

835e854d90e709e8c6e083e807cc561d_JaffaCakes118
Size

380KB
MD5

835e854d90e709e8c6e083e807cc561d
SHA1

100e536f0e6bfbb0d4b2ba672c9ace66d7b4c53f
SHA256

2e56ac503de2d63f84171a3b30af654d1e2bb2722d4965d52a497100393c6925
SHA512

72e0a06c88d913844f7f881cdcaa2a070adf15dac6b9c0efd89bca658f66b3f718eee5be74d860db314668a82583f9ee870ddec33d891a27e1814770ee21f4d5
SSDEEP

6144:ChI/E/6dUmjCqU40zlw5NXrOod/vC+z+YR8RL8FjW+1F0I+jskEyVVKO1AQCFVn:kIDenzl9q/KlYR8R4Fv9YskM3FV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
835e854d90e709e8c6e083e807cc561d_JaffaCakes118

Files

835e854d90e709e8c6e083e807cc561d_JaffaCakes118
.dll windows:4 windows x86 arch:x86

18a20b1f6c4f764017bef49164348d9e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

SHRegDuplicateHKey

kernel32

LCMapStringW
MultiByteToWideChar
LCMapStringA
SetFilePointer
CreateFileA
FlushFileBuffers
SetStdHandle
VirtualQuery
InterlockedExchange
RtlUnwind
InitializeCriticalSection
GetCPInfo
GetOEMCP
GetACP
LoadLibraryA
VirtualAlloc
LeaveCriticalSection
EnterCriticalSection
CloseHandle
VirtualFree
HeapCreate
HeapDestroy
TlsAlloc
TlsGetValue
TlsSetValue
SetLastError
TlsFree
DeleteCriticalSection
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStdHandle
WriteFile
GetModuleHandleA
GetStringTypeA
HeapAlloc
HeapReAlloc
HeapFree
GetLocalTime
GetCommandLineA
GetStartupInfoA
SetEndOfFile
GetStringTypeW
ReadFile
VirtualProtect
GetSystemInfo
lstrcpynA
lstrcmpA
OutputDebugStringA
GetWindowsDirectoryA
GetVersionExA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
CreateMutexA
lstrcmpiA
GetSystemDirectoryA
GetPrivateProfileStringA
LoadLibraryExA
GetProcAddress
FreeLibrary
GetPrivateProfileSectionA
lstrlenA
lstrcpyA
FindFirstFileA
FindClose
GetLastError
InterlockedDecrement
InterlockedExchangeAdd
GetLocaleInfoA
ExitProcess
GetProcessHeap

ole32

CoInitialize

advapi32

RegQueryValueExA
RegCloseKey
RegDeleteValueA
RegOpenKeyExA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

winmm

mmioInstallIOProcA

setupapi

SetupCloseInfFile
SetupFindNextLine
SetupGetLineTextA
SetupFindFirstLineA
SetupOpenInfFileA

Sections

.code
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 332KB - Virtual size: 361KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

18a20b1f6c4f764017bef49164348d9e

Headers

File Characteristics

Imports

shlwapi

kernel32

ole32

advapi32

version

winmm

setupapi

Sections

.code Size: 32KB - Virtual size: 31KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 332KB - Virtual size: 361KB

.rsrc Size: 4KB - Virtual size: 792B

.reloc Size: 4KB - Virtual size: 1KB

.code
Size: 32KB - Virtual size: 31KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 332KB - Virtual size: 361KB

.rsrc
Size: 4KB - Virtual size: 792B

.reloc
Size: 4KB - Virtual size: 1KB