a40fe6a1d4996f52748371207bcf2c98_JaffaCakes118

General

Target

a40fe6a1d4996f52748371207bcf2c98_JaffaCakes118
Size

37KB
MD5

a40fe6a1d4996f52748371207bcf2c98
SHA1

e8e5124594b5839dd3bfe267e0a66327fee28d36
SHA256

e34a312ed5d22190d1b4240a8bcd83086b220fdeded228ab825697d6df3de176
SHA512

fb255e24fd890d00396cc6a00f1e7ab6073719a2abb000bc5e40ec3974c3cceeb54bcdc5ae9fe692291411051f74f0b8a7660ca36ca637699719e4d59a4cf3fd
SSDEEP

768:qBacFOne5E0DsvOJZYcskY+OfP3aUSfJCh:qBacF+erkdfUfY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a40fe6a1d4996f52748371207bcf2c98_JaffaCakes118

Files

a40fe6a1d4996f52748371207bcf2c98_JaffaCakes118
.dll windows:6 windows x86 arch:x86

d7c9150e35d56f0a7edeacae5d6cd7d9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

memcmp
memcpy
memset
_strnicmp
??1type_info@@UAE@XZ
strrchr
isdigit
_beginthread
strncmp
_itoa
fwrite
printf
atoi
fseek
ftell
fread
fopen
fclose
_strdup
isalnum
strchr
strstr
sprintf
tmpfile
realloc
free
??2@YAPAXI@Z
_iob
??3@YAXPAX@Z
fprintf
strncpy
memchr
malloc

psapi

GetModuleInformation

crypt32

CertGetIssuerCertificateFromStore
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertNameToStrA
CertGetCertificateChain
CertOpenSystemStoreA
CertFreeCertificateChain
CertCloseStore
CertFindChainInStore

secur32

InitializeSecurityContextA
AcquireCredentialsHandleA
FreeContextBuffer
DecryptMessage
ApplyControlToken
QueryContextAttributesA
FreeCredentialsHandle
EncryptMessage
DeleteSecurityContext

kernel32

GetFileAttributesA
VirtualProtect
lstrcmpiW
GetModuleFileNameA
WinExec
lstrcmpA
GetProcAddress
WideCharToMultiByte
OpenMutexW
CloseHandle
lstrlenA
Sleep
GlobalFree
OutputDebugStringA
MultiByteToWideChar
GetLastError
CreateFileA
CreateMutexW
GetModuleHandleW
WriteFile
GlobalAlloc
GetCommandLineA
GetCurrentProcess

advapi32

RegQueryValueExA
RegOpenKeyExA

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d7c9150e35d56f0a7edeacae5d6cd7d9

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

psapi

crypt32

secur32

kernel32

advapi32

Sections

.text Size: 27KB - Virtual size: 26KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 1024B - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 27KB - Virtual size: 26KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 1024B - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB