a2e5457c6d0280f29339557760a386f5_JaffaCakes118

General

Target

a2e5457c6d0280f29339557760a386f5_JaffaCakes118
Size

24KB
MD5

a2e5457c6d0280f29339557760a386f5
SHA1

e4abb8944ffa2bf7ffa2e9a18f389e1677c7352e
SHA256

726fdc94be5244c50cd0ea3e0975bfe3759588a26bbf09fd70f1b01e0995a483
SHA512

9d4d061e009d62fde778e9480f71c88c1c0be5a788d831f9728c2be3b85c797cdd877b45b0a40ef06b6656d7f631cecd988c557cb2f3c0b7fee424097ef910e5
SSDEEP

384:Tp+BscWu+w4PTXjw4mIUenKnRXjwoHbg+yXDr:zPnWsOVk/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a2e5457c6d0280f29339557760a386f5_JaffaCakes118

Files

a2e5457c6d0280f29339557760a386f5_JaffaCakes118
.dll windows:4 windows x86 arch:x86

cced4543670eb43094232a13bead24d1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
Process32First
CreateToolhelp32Snapshot
ReleaseMutex
GetLastError
CreateMutexA
OpenProcess
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
LoadLibraryA
WriteProcessMemory
VirtualAllocEx
FindClose
FindNextFileA
lstrcpynA
lstrcmpA
FindFirstFileA
VirtualProtectEx
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
Module32Next
Module32First
ReadFile
Process32Next
WinExec
TerminateProcess
GetCurrentProcess
GetModuleHandleA
GetProcAddress
WriteFile
GetTempPathA
GetTickCount
lstrcpyA
Sleep
CreateThread
CloseHandle
GetModuleFileNameA
GetSystemDirectoryA
lstrlenW
GetCurrentProcessId

user32

EnumWindows
GetWindowThreadProcessId
SetThreadDesktop
OpenDesktopA
SetProcessWindowStation
OpenWindowStationA
wsprintfA

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

shlwapi

StrStrIA

msvcrt

strcpy
strcmp
_purecall
strstr
strncat
strcat
strlen
memset
memcpy
_itoa
??3@YAXPAX@Z
??2@YAPAXI@Z

wininet

InternetCloseHandle

Sections

.bss
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cced4543670eb43094232a13bead24d1

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

msvcrt

wininet

Sections

.bss Size: - Virtual size: 13KB

.data Size: 17KB - Virtual size: 16KB

.reloc Size: 2KB - Virtual size: 1KB

.bss
Size: - Virtual size: 13KB

.data
Size: 17KB - Virtual size: 16KB

.reloc
Size: 2KB - Virtual size: 1KB