a9dde4ccee4d8bfc9209213667a18cb4_JaffaCakes118

General

Target

a9dde4ccee4d8bfc9209213667a18cb4_JaffaCakes118
Size

37KB
MD5

a9dde4ccee4d8bfc9209213667a18cb4
SHA1

448bb8c5c037023605eeeb6c40a822ae9d78dc4d
SHA256

e6d5b08887e3366129984e5a1b7013b78520d512b6040607632755809ecbd193
SHA512

d69e4b01b3fae506ec9b63b6c5c9fb79fce0de5c637ca381290ec591c309e707254420babd1dee9129314a3ebf3b8337e6d415af4921a24a3d43d94b1475abec
SSDEEP

768:yKkDLPJyrBb2CwFdpWTRYvUqTv2k43x2OAlhCw+5nx9OzdGyaU:jkDQr4CspWqvUqr43x2O4C9zJbU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a9dde4ccee4d8bfc9209213667a18cb4_JaffaCakes118

Files

a9dde4ccee4d8bfc9209213667a18cb4_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b561bbd49c231e46109d157eddf97d37

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
GetFileSize
CreateFileA
WriteFile
MultiByteToWideChar
FindClose
FindFirstFileA
GetModuleFileNameA
GetTempPathA
GetWindowsDirectoryA
FindNextFileA
DeleteFileA
ReadFile
GetCurrentProcess
TerminateProcess
CreateThread
Sleep
GetTickCount
CopyFileA
lstrcatA
lstrcpyA
LocalAlloc
lstrcmpiA
LoadLibraryA
GetProcAddress

user32

UnregisterClassA
LoadCursorA
RegisterClassExA
GetKeyboardLayout
GetKeyboardLayoutList
MessageBoxA
SystemParametersInfoA

advapi32

RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

imm32

ImmIsIME

msvcrt

_except_handler3
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
strstr
strcpy
atoi
_strlwr
strrchr
strlen
_stricmp
sprintf
memset
strcat

Exports

Exports

CandWndProc
CompWndProc
IMEClearPubString
IMESetPubString
ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME
StatusWndProc
UIWndProc
pfjieaoidjglkajd

Sections

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b561bbd49c231e46109d157eddf97d37

Headers

File Characteristics

Imports

kernel32

user32

advapi32

imm32

msvcrt

Exports

Exports

Sections

.bss Size: - Virtual size: 1KB

.data Size: 8KB - Virtual size: 7KB

.rsrc Size: 1024B - Virtual size: 816B

.reloc Size: 1024B - Virtual size: 808B

.bss
Size: - Virtual size: 1KB

.data
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 1024B - Virtual size: 816B

.reloc
Size: 1024B - Virtual size: 808B