8bc488868d3da47391bf4db89922952c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8bc488868d3da47391bf4db89922952c_JaffaCakes118
Size

152KB
MD5

8bc488868d3da47391bf4db89922952c
SHA1

c08e4763785f0317ad0515c0d5afd0d4aa00b819
SHA256

fd8f3bcd83ab2a08b985e6ec790eda7be63d629c98eb5e7826442bb8207f60a2
SHA512

e1ec10034f43e6d5834972697f07f2742b091ace3a0da26490fffc43208e40b7bb7e2d4591ce84110991d3be7fc2f19b1b6f37058dc14cc2c4cdd88c7d489836
SSDEEP

3072:1qW3RWAaU3onFJ+ssAiqexi8fGQM1rejP0FQoe:1qnooFNizxmQMo5o

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8bc488868d3da47391bf4db89922952c_JaffaCakes118

Files

8bc488868d3da47391bf4db89922952c_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b0b030e9ae78928b318cb3c15f9d9032

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MapViewOfFile
CreateFileA
GetModuleHandleA
WriteFile
LoadLibraryA
GetProcAddress
CreateFileMappingA
TerminateProcess
SetLastError
InterlockedDecrement
CopyFileA
ReadProcessMemory
ExitProcess
OpenEventA
GetTickCount
GetCommandLineA
LocalFree
UnmapViewOfFile
GlobalAlloc
GetLastError
CreateDirectoryA
GetVolumeInformationA
GetProcessHeap
Sleep
GetModuleFileNameA
WaitForSingleObject
CloseHandle
CreateEventA
GetComputerNameA
CreateProcessA
CreateMutexW
GlobalFree
EnterCriticalSection
InterlockedIncrement
WriteProcessMemory
LeaveCriticalSection
HeapAlloc
GetCurrentProcess
OpenFileMappingA
InterlockedCompareExchange
HeapFree

ole32

CoCreateInstance
OleCreate
CoUninitialize
CoSetProxyBlanket
CoTaskMemAlloc
CoInitialize
CoCreateGuid
OleSetContainedObject

user32

UnhookWindowsHookEx
DestroyWindow
GetClassNameA
DefWindowProcA
TranslateMessage
GetWindowLongA
PeekMessageA
RegisterWindowMessageA
DispatchMessageA
KillTimer
GetMessageA
SetWindowsHookExA
GetWindowThreadProcessId
FindWindowA
GetParent
PostQuitMessage
SendMessageA
GetWindow
SetTimer
CreateWindowExA
GetSystemMetrics
GetCursorPos
ScreenToClient
ClientToScreen
SetWindowLongA

oleaut32

SysStringLen
SysAllocString
SysAllocStringLen
SysFreeString

shlwapi

UrlUnescapeW
StrStrIW

advapi32

SetTokenInformation
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
DuplicateTokenEx
GetUserNameA
OpenProcessToken
RegDeleteValueA

shell32

SHGetFolderPathA

Exports

Exports

nsCommshid

Sections

.text
Size: 120KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 953B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

kud
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b0b030e9ae78928b318cb3c15f9d9032

Headers

File Characteristics

Imports

kernel32

ole32

user32

oleaut32

shlwapi

advapi32

shell32

Exports

Exports

Sections

.text Size: 120KB - Virtual size: 117KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 953B

kud Size: 4KB - Virtual size: 8B

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 120KB - Virtual size: 117KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 953B

kud
Size: 4KB - Virtual size: 8B

.reloc
Size: 8KB - Virtual size: 6KB