a5267798f0ee00eafd7816082b483ca5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a5267798f0ee00eafd7816082b483ca5_JaffaCakes118
Size

72KB
MD5

a5267798f0ee00eafd7816082b483ca5
SHA1

ef9352c4b7750466259f082b9211c1f185267802
SHA256

f6e0ce99d993b191d5384aff3bb6d30fffac0fa6d49e766d6c8ca026e1a49d3a
SHA512

b4c3579e043bd57f748c988b13933069937a07cce0cc7af0f43008fecb7b90d4870d84e32796c4c78b7041f342f0e6af5d169d891b03fc2216eb9627bc9b70e6
SSDEEP

768:mFP/BmbydaLZXldq81Nh05qPZOPNK4BMBZ4TmG2unZgPfmuYxkjmtTRqwzHwtWYg:mFhmbQaLZ75N5v4lZImuYnhQtP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a5267798f0ee00eafd7816082b483ca5_JaffaCakes118

Files

a5267798f0ee00eafd7816082b483ca5_JaffaCakes118
.dll windows:4 windows x86 arch:x86

34149aa2d743bce24771fac3dbb289b0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Imports

kernel32

CreateThread
FreeLibrary
GetProcAddress
GetSystemDirectoryA
lstrcatA
CreateFileA
WriteFile
lstrcpyA
TerminateProcess
GetCurrentProcess
LoadLibraryA
OpenMutexA
Sleep
GetTempPathA
CopyFileA
CloseHandle
CreateMutexA
ExitProcess
WaitForMultipleObjects
TerminateThread
ReleaseMutex
GetVolumeInformationA
GetModuleFileNameA
lstrcmpiA
CreateMutexW
GetSystemDefaultLCID
GetSystemDirectoryW
lstrcpyW
lstrcatW
GetModuleHandleA
lstrlenA
GetLastError
GetLocaleInfoA
GlobalFree
DeleteFileA
GlobalAlloc
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
RtlUnwind
HeapSize
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
VirtualAlloc
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetStdHandle
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId

user32

wsprintfA

advapi32

RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA

ws2_32

listen
bind
gethostname
gethostbyname
shutdown
accept
recv
send
connect
inet_addr
htons
closesocket
socket
WSAStartup
WSACleanup
inet_ntoa

Exports

Exports

_tDllFunc2@4
_tDllFunc@4

Sections

.text
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

34149aa2d743bce24771fac3dbb289b0

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ws2_32

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 36KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 8KB - Virtual size: 122KB

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 40KB - Virtual size: 36KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 8KB - Virtual size: 122KB

.reloc
Size: 8KB - Virtual size: 5KB