8707e07c71b2202431bd24f75442b487_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

8707e07c71b2202431bd24f75442b487_JaffaCakes118
Size

120KB
MD5

8707e07c71b2202431bd24f75442b487
SHA1

3374d67906b98fa19440710cf3fe9bfb894262de
SHA256

f02b5d6c5646a4ad14d546731e29dce4a2afeef31d2ef01a31a82df24989b6cb
SHA512

02ee127f74e3ea4bba0cd5420d843219ae9f36d986ae73ec2ff722c27eb94dc816d7bf17acb0005742bd2ba24c8cf1e3e46cfb0f12e4947694c256f5416970a3
SSDEEP

1536:x33Ltn254MsTx/to0tndIN3Hc+4qQfVne0eW5WsOGsb9:xHLtnokt3xeN3H14qqVne0eW5fOGsb9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8707e07c71b2202431bd24f75442b487_JaffaCakes118

Files

8707e07c71b2202431bd24f75442b487_JaffaCakes118
.dll windows:4 windows x86 arch:x86

eb3ad8a67d94e9de40d92ac3a1952dcb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetEvent
GetQueuedCompletionStatus
CreateThread
CreateIoCompletionPort
ResetEvent
Sleep
WaitForSingleObject
WinExec
TerminateThread
lstrcatA
GetLocalTime
lstrcpyA
lstrcmpA
CreateProcessA
GetSystemDirectoryA
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
TerminateProcess
PeekNamedPipe
WaitForMultipleObjects
GetVersionExA
GetCurrentProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
FreeLibrary
GetProcAddress
LoadLibraryA
OpenProcess
GetExitCodeThread
GetTickCount
SetErrorMode
FreeConsole
LocalSize
GetLastError
ReadFile
FlushFileBuffers
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
CreateEventA
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetEnvironmentStringsW
CreateFileA
GetFileSize
CloseHandle
RemoveDirectoryA
LocalAlloc
FindFirstFileA
LocalReAlloc
FindNextFileA
LocalFree
InitializeCriticalSection
FindClose
GetLogicalDriveStringsA
GetVolumeInformationA
lstrlenA
GetDiskFreeSpaceExA
GetDriveTypeA
DeleteFileA
VirtualAlloc
EnterCriticalSection
GetEnvironmentStrings
FreeEnvironmentStringsW
LeaveCriticalSection
VirtualFree
FreeEnvironmentStringsA
GetModuleFileNameA
GetFileType
GetStdHandle
SetHandleCount
IsBadWritePtr
HeapCreate
HeapDestroy
HeapSize
ExitProcess
TlsGetValue
SetLastError
TlsFree
MoveFileA
WriteFile
SetFilePointer
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetModuleHandleA
RaiseException
HeapFree
GetVersion
DeleteCriticalSection
SetStdHandle
GetCommandLineA
WideCharToMultiByte
InterlockedIncrement
RtlUnwind
HeapAlloc
HeapReAlloc
InterlockedDecrement

user32

GetWindowTextA
GetActiveWindow
GetKeyNameTextA
GetFocus
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
ReleaseDC
GetDC
wsprintfA
CloseDesktop
GetDesktopWindow
SetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
CloseWindow
IsWindow
SendMessageA
CreateWindowExA
GetSystemMetrics
ExitWindowsEx
EnumWindows
IsWindowVisible
GetWindowThreadProcessId

gdi32

GetDIBits
CreateDCA
CreateDIBSection
BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject

advapi32

RegisterServiceCtrlHandlerExA
RegQueryValueExA
RegOpenKeyA
AdjustTokenPrivileges
SetServiceStatus
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA

shell32

SHGetFileInfoA

dbghelp

MakeSureDirectoryPathExists

ws2_32

connect
htons
gethostbyname
socket
WSAGetLastError
inet_ntoa
closesocket
getpeername
getsockname
gethostname
WSARecv
WSAStartup
send
ntohs

imm32

ImmGetCompositionStringA
ImmReleaseContext
ImmGetContext

wininet

InternetReadFile
InternetCloseHandle
InternetOpenA
InternetOpenUrlA

urlmon

URLDownloadToFileA

avicap32

capCreateCaptureWindowA

psapi

EnumProcessModules
GetModuleFileNameExA

Exports

Exports

ServiceMain

Sections

.text
Size: 80KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eb3ad8a67d94e9de40d92ac3a1952dcb

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

dbghelp

ws2_32

imm32

wininet

urlmon

avicap32

psapi

Exports

Exports

Sections

.text Size: 80KB - Virtual size: 76KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 12KB - Virtual size: 16KB

.shared Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 80KB - Virtual size: 76KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 12KB - Virtual size: 16KB

.shared
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 5KB