a4736579353fdd8f9556525707971056_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a4736579353fdd8f9556525707971056_JaffaCakes118
Size

80KB
MD5

a4736579353fdd8f9556525707971056
SHA1

6a30825dfa65d71307f9b87fa0fcbbbec2bcae8c
SHA256

8f13e25d20a4b26e79513f86c4f142c86761218d223ff0bdd4dd6d1a79d7de1c
SHA512

398987a26da90d3efc2807cfe9ac29cd0d5b05a1fab0b9c30cce6673415cfce7daedace38634b96b0430b1daac661e1c8399cfb9655a7661df129e33a3e9021c
SSDEEP

1536:l4RVp3QKPpx/UfZrS5QAaAyv4a1NDFQ4SkMd5Rg4nWKxizKfBYYLU:l63Npx/UfLqy4a1NDFQ4SkMHRgJCizKW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4736579353fdd8f9556525707971056_JaffaCakes118

Files

a4736579353fdd8f9556525707971056_JaffaCakes118
.dll windows:4 windows x86 arch:x86

2aa7c4cc70552ca4f223f296910b6bac

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

time
realloc
_snprintf
srand
_adjust_fdiv
strlen
rand
malloc
strrchr
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
wcsstr
wcsncpy
_strlwr
strstr
sscanf
memset
strcat
strcpy
isdigit
__CxxFrameHandler
strchr
strncpy
atoi
free
_except_handler3
_initterm
_strcmpi
_stricmp

kernel32

VirtualProtectEx
DisableThreadLibraryCalls
ExitProcess
CreateMutexA
GetLastError
WinExec
CloseHandle
GetProcAddress
GetModuleFileNameA
GetModuleHandleA
LoadLibraryA
OpenEventA
ReadFile
WritePrivateProfileStringA
GetCommandLineA
GetPrivateProfileStringA
IsBadReadPtr
lstrlenW
WideCharToMultiByte

user32

wsprintfA
wvsprintfA

wininet

InternetReadFile

urlmon

URLDownloadToCacheFileA

Exports

Exports

WahCloseApcHelper
WahCloseHandleHelper
WahCloseNotificationHandleHelper
WahCloseSocketHandle
WahCloseThread
WahCompleteRequest
WahCreateHandleContextTable
WahCreateNotificationHandle
WahCreateSocketHandle
WahDestroyHandleContextTable
WahDisableNonIFSHandleSupport
WahEnableNonIFSHandleSupport
WahEnumerateHandleContexts
WahInsertHandleContext
WahNotifyAllProcesses
WahOpenApcHelper
WahOpenCurrentThread
WahOpenHandleHelper
WahOpenNotificationHandleHelper
WahQueueUserApc
WahReferenceContextByHandle
WahRemoveHandleContext
WahWaitForNotification

Sections

.text
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DDK0
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DDK1
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2aa7c4cc70552ca4f223f296910b6bac

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

wininet

urlmon

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 30KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 20KB - Virtual size: 25KB

DDK0 Size: 4KB - Virtual size: 3KB

DDK1 Size: 12KB - Virtual size: 9KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 32KB - Virtual size: 30KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 20KB - Virtual size: 25KB

DDK0
Size: 4KB - Virtual size: 3KB

DDK1
Size: 12KB - Virtual size: 9KB

.reloc
Size: 4KB - Virtual size: 3KB