84f61cfab082b8eea7f4aa2a47325fc6_JaffaCakes118

General

Target

84f61cfab082b8eea7f4aa2a47325fc6_JaffaCakes118
Size

20KB
MD5

84f61cfab082b8eea7f4aa2a47325fc6
SHA1

5868a7261da02b4cbceaf283220de65fff51e180
SHA256

b41e98f93e8f40a4da72782ce013a966e1e4f4996bf1cdaadf79e84880965f95
SHA512

ced57365fffce84103da163a6e24205258a07cba9331d4dabc64b52413dd244ccbf02365dfd5bee5bdc9c2b2093d6c5864fcf744229aebbe7109aca387370a69
SSDEEP

192:oP8uBfuD4cnYaOSQndRBLw3IGMCp09nbmElFpK8bkyTbS7085el4lEUKzH4H:oPb44NSQnd5GcyEl7KCFm70seIEmH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
84f61cfab082b8eea7f4aa2a47325fc6_JaffaCakes118

Files

84f61cfab082b8eea7f4aa2a47325fc6_JaffaCakes118
.dll windows:4 windows x86 arch:x86

6d2fc66306cfd26a32b8388282c7e98d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReleaseMutex
GetLastError
OpenProcess
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
LoadLibraryA
WriteProcessMemory
VirtualAllocEx
FindClose
FindNextFileA
lstrcpynA
lstrcpyA
lstrcmpA
FindFirstFileA
VirtualProtectEx
WideCharToMultiByte
lstrlenW
lstrcmpiA
Module32First
ReadFile
GetModuleFileNameA
CreateToolhelp32Snapshot
TerminateProcess
GetCurrentProcess
Process32Next
GetSystemDirectoryA
lstrlenA
GetModuleHandleA
GetProcAddress
WriteFile
GetTempPathA
GetTickCount
WinExec
Process32First
CreateMutexA
GetPrivateProfileStringA
GetPrivateProfileIntA
Sleep
ResumeThread
GetCurrentProcessId
CreateThread
Module32Next
CloseHandle

user32

SetThreadDesktop
OpenDesktopA
SetProcessWindowStation
OpenWindowStationA
wsprintfA

advapi32

OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

shlwapi

StrStrIA

msvcrt

strlen
strcmp
_purecall
strstr
strncat
strcat
atoi
isprint
??3@YAXPAX@Z
strcpy
??2@YAPAXI@Z
memcpy
memset
_itoa

wininet

InternetCloseHandle

Sections

.bss
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6d2fc66306cfd26a32b8388282c7e98d

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

msvcrt

wininet

Sections

.bss Size: - Virtual size: 13KB

.data Size: 15KB - Virtual size: 15KB

.shared Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.bss
Size: - Virtual size: 13KB

.data
Size: 15KB - Virtual size: 15KB

.shared
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB