8b0e32584e7a3254891147ae32f01bc0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8b0e32584e7a3254891147ae32f01bc0_JaffaCakes118
Size

1.8MB
MD5

8b0e32584e7a3254891147ae32f01bc0
SHA1

bc013a51ce24db7d81733e6f6ecd03a4ae5e5bf5
SHA256

e20cf0da7dab49de8aa69c92215271abf8886ea07ae4765b41f9096b9e983f83
SHA512

a69895889d9efef58f1550fab3c5fc70f8be6d95deda522e65d5595adf1e921397c7ed730cf34258cb96c15a6d3fc264683e0bfef415ae8100482e0316dbb937
SSDEEP

49152:o3lmuT5Pr+Dv71QeBGH1yNsC41tNkQo4m:gku9sdBYEsL5m

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8b0e32584e7a3254891147ae32f01bc0_JaffaCakes118

Files

8b0e32584e7a3254891147ae32f01bc0_JaffaCakes118
.dll windows:6 windows x86 arch:x86

ad69a8834e3b2cdb020b380dafa9b59b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualAlloc
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

SetWindowLongA
CharUpperBuffW

shell32

SHGetFolderPathA

oleaut32

SysFreeString

msvcp140

??1_Lockit@std@@QAE@XZ

d3dx9_43

D3DXCreateTextureFromFileInMemoryEx

imm32

ImmSetCompositionWindow

vcruntime140

__CxxFrameHandler3

api-ms-win-crt-stdio-l1-1-0

fclose

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-string-l1-1-0

_stricmp

api-ms-win-crt-runtime-l1-1-0

_initterm

api-ms-win-crt-math-l1-1-0

fmaxf

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-convert-l1-1-0

mbstowcs_s

api-ms-win-crt-locale-l1-1-0

localeconv

Exports

Exports

?runtime_basis@@3IA

Sections

.text
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 608KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.2fE0
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.2fE1
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ad69a8834e3b2cdb020b380dafa9b59b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

oleaut32

msvcp140

d3dx9_43

imm32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: - Virtual size: 1.1MB

.rdata Size: - Virtual size: 608KB

.data Size: - Virtual size: 2.3MB

.2fE0 Size: - Virtual size: 1.3MB

.2fE1 Size: 1.8MB - Virtual size: 1.8MB

.reloc Size: 1024B - Virtual size: 736B

.rsrc Size: 512B - Virtual size: 469B

.text
Size: - Virtual size: 1.1MB

.rdata
Size: - Virtual size: 608KB

.data
Size: - Virtual size: 2.3MB

.2fE0
Size: - Virtual size: 1.3MB

.2fE1
Size: 1.8MB - Virtual size: 1.8MB

.reloc
Size: 1024B - Virtual size: 736B

.rsrc
Size: 512B - Virtual size: 469B