a44222e927955573efc3ba42f013743d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a44222e927955573efc3ba42f013743d_JaffaCakes118
Size

144KB
MD5

a44222e927955573efc3ba42f013743d
SHA1

8e64d34cc3c0b1208c2684b91f12a29bef694524
SHA256

d1041530671ac9daf1bc820552d54207532c456e5c5f44638ad69bffcc072f72
SHA512

91819ef3a247fb641c0714cbc20e2a4367632f2652c7a37310c4aeddc48d868c5ce742c6a36cbad3e5eae43b9806e9e993d90a09e8c11599d8bc2356f6ae2926
SSDEEP

1536:okWFrvWJ/c9m0Y4vtY8dEYYZSTETiSrnFELUC0y3oOw6b0AcbN3b:nWFroc9Jjvym4RiYly3anAcbh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a44222e927955573efc3ba42f013743d_JaffaCakes118

Files

a44222e927955573efc3ba42f013743d_JaffaCakes118
.dll windows:4 windows x86 arch:x86

5024901f71dbcd380764b496dcb6ed9b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLocalTime
SetEndOfFile
LeaveCriticalSection
EnterCriticalSection
CreateFileA
DisableThreadLibraryCalls
InitializeCriticalSection
CreateThread
MultiByteToWideChar
GlobalFree
GlobalUnlock
GlobalHandle
WriteFile
SetFilePointer
GetLastError
CreateEventW
DeviceIoControl
CreateFileW
SetLastError
SetEvent
ReadFile
WaitForSingleObject
QueryPerformanceFrequency
QueryPerformanceCounter
GetFullPathNameW
GetCurrentProcessId
GetSystemDirectoryA
GetWindowsDirectoryA
WideCharToMultiByte
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetCurrentProcess
GetVersion
InterlockedCompareExchange
InterlockedIncrement
Sleep
ResumeThread
GlobalAlloc
GlobalLock
LocalFree
ExitProcess
DeleteCriticalSection
FlushFileBuffers
SetStdHandle
LoadLibraryA
GetOEMCP
GetACP
InterlockedDecrement
CloseHandle
GetStringTypeA
GetStringTypeW
CreateRemoteThread
OpenProcess
DuplicateHandle
VirtualAlloc
VirtualFree
ReadProcessMemory
WriteProcessMemory
VirtualQuery
GetExitCodeThread
SuspendThread
TerminateThread
GetThreadContext
SetThreadContext
LCMapStringW
lstrcmpiW
lstrcmpiA
RtlUnwind
HeapAlloc
HeapFree
GetCommandLineA
TlsGetValue
TlsFree
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
HeapReAlloc
TerminateProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
GetCPInfo
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
LCMapStringA

user32

MessageBoxA
GetWindowLongA
SendMessageA
GetClassNameA
GetWindowModuleFileNameA
GetWindowTextA
EnumChildWindows
wsprintfW
CallNextHookEx
GetParent
SetWindowsHookExA
ToAscii
GetKeyboardState
GetFocus
GetActiveWindow
UnhookWindowsHookEx
MessageBoxW

advapi32

OpenServiceW
OpenSCManagerW
LookupAccountSidA
RegCloseKey
RegSetValueExA
RegCreateKeyA
RegDeleteValueA
RegEnumValueA
RegOpenKeyA
GetUserNameA
CloseServiceHandle
CreateServiceW
ControlService
StartServiceW
QueryServiceStatus
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyW

ws2_32

ntohs

Exports

Exports

AddHiddenFileDir
AddHiddenKey
AddHiddenProcId
AddHiddenProcName
AddHiddenServ
AddHiddenTCPPort
AddHiddenUDPPort
AddHiddenUser
AddHiddenValue
Add_DLL
ApiHookChain
ConServerDllInitialization
DelHiddenFileDir
DelHiddenKey
DelHiddenProcId
DelHiddenProcName
DelHiddenServ
DelHiddenTCPPort
DelHiddenUDPPort
DelHiddenUser
DelHiddenValue
GetHiddenFileDirName
GetHiddenKeyName
GetHiddenProcId
GetHiddenProcName
GetHiddenServName
GetHiddenTCPPort
GetHiddenUDPPort
GetHiddenUserName
GetHiddenValueName
Hook_Start
Hook_Stop
HooksCanUnloadNow
KeyLog_Start
KeyLog_Stop
PacketAllocatePacket
PacketCloseAdapter
PacketFreePacket
PacketGetAdapterNames
PacketGetNetInfo
PacketGetNetInfoEx
PacketGetNetType
PacketGetReadEvent
PacketGetStats
PacketGetStatsEx
PacketGetVersion
PacketInitPacket
PacketIsDumpEnded
PacketLibraryVersion
PacketOpenAdapter
PacketReceivePacket
PacketRequest
PacketSendPacket
PacketSendPackets
PacketSetBpf
PacketSetBuff
PacketSetDumpLimits
PacketSetDumpName
PacketSetHwFilter
PacketSetMinToCopy
PacketSetMode
PacketSetNumWrites
PacketSetReadTimeout
PacketStopDriver

Sections

.text
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

ApiHooks
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PrcWorks
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARDAT
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5024901f71dbcd380764b496dcb6ed9b

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ws2_32

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 52KB

ApiHooks Size: 16KB - Virtual size: 12KB

PrcWorks Size: 4KB - Virtual size: 2KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 20KB - Virtual size: 49KB

.SHARDAT Size: 28KB - Virtual size: 26KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 56KB - Virtual size: 52KB

ApiHooks
Size: 16KB - Virtual size: 12KB

PrcWorks
Size: 4KB - Virtual size: 2KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 20KB - Virtual size: 49KB

.SHARDAT
Size: 28KB - Virtual size: 26KB

.reloc
Size: 8KB - Virtual size: 6KB