94c0948107e32227a852c4f82d5bc0d6_JaffaCakes118

General

Target

94c0948107e32227a852c4f82d5bc0d6_JaffaCakes118
Size

26KB
MD5

94c0948107e32227a852c4f82d5bc0d6
SHA1

95178b4684c0a6b2f0421b499cea4dc971356858
SHA256

0d8214c36b893fd2652507c0b890b32594857d145e7a5774cb3fd1fb9f94dd32
SHA512

a0ab7a62d868a8a50b9dd79e381993a441dda6a84aefa0d4a538ec9e235bc32ace99df8820257af95fcfa29b894f97ae53e12fd189d6c656823965e04ec0c1e8
SSDEEP

384:h2Q6RdoXvepd/DOJqXv72ZM4aaISFIms+Vbyr2MrmS3S5xIPVT:h2PWmplOcXOM4/Ia8mKGxIP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
94c0948107e32227a852c4f82d5bc0d6_JaffaCakes118

Files

94c0948107e32227a852c4f82d5bc0d6_JaffaCakes118
.dll windows:4 windows x86 arch:x86

3699cb79cfb330624a85149642670498

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
CreateEventA
SetEvent
WriteFile
IsBadReadPtr
GetCommandLineA
CreateMutexA
GetCurrentProcessId
ReadProcessMemory
GetComputerNameA
InitializeCriticalSection
VirtualProtectEx
GetPrivateProfileStringA
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
LoadLibraryA
GetModuleHandleA
WaitForSingleObject
GetModuleFileNameA
GetCurrentThreadId
GetCurrentProcess
ExitProcess
WriteProcessMemory
ResetEvent
CreateFileA
ReadFile
CloseHandle
DeleteFileA
GetTempPathA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
TerminateThread
CreateThread
Sleep

user32

FindWindowA
GetDesktopWindow
GetWindowThreadProcessId
GetClassNameA
GetWindowTextA
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
GetWindow

msvcrt

free
_initterm
malloc
_strnicmp
_adjust_fdiv
_stricmp
_strlwr
sprintf
strcpy
strlen
strstr
strcat
memcpy
??2@YAPAXI@Z
strrchr
memset
strncpy
strchr
strcmp
wcslen
fclose
fread
fopen

wininet

InternetOpenA
InternetReadFile
InternetCloseHandle
InternetOpenUrlA

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdt
Size: 512B - Virtual size: 153B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3699cb79cfb330624a85149642670498

Headers

File Characteristics

Imports

kernel32

user32

msvcrt

wininet

Sections

.text Size: 16KB - Virtual size: 16KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 3KB - Virtual size: 4KB

sdt Size: 512B - Virtual size: 153B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 16KB - Virtual size: 16KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 3KB - Virtual size: 4KB

sdt
Size: 512B - Virtual size: 153B

.reloc
Size: 2KB - Virtual size: 2KB