adca52fa0c2763d39c8c41a917338113_JaffaCakes118

General

Target

adca52fa0c2763d39c8c41a917338113_JaffaCakes118
Size

60KB
MD5

adca52fa0c2763d39c8c41a917338113
SHA1

4ff2549890d3957c29aa140cf2af112a3efaf6e7
SHA256

1d738d4b8186e46ce4bdc0a9d08ad95f0b72f19e73fd49bbec00aa3963017429
SHA512

25abbe6581cb8e77c2494f985711ca9c20391f8ed8db20d371ad3f29f4662c4ecc7ec789363e0ccc021fbf9c262ece422ab829067a05b12dc274de2e2fa0f07f
SSDEEP

768:2ahH1PYQs1ImrIS/3bQpkQxcUQstXZ9ndTG:2ewJrF/rQpkQeCtJ9hG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
adca52fa0c2763d39c8c41a917338113_JaffaCakes118

Files

adca52fa0c2763d39c8c41a917338113_JaffaCakes118
.dll windows:4 windows x86 arch:x86

58fde0ef3721a7aff0acfbc0107ae5dd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
GetProcAddress
Sleep
LocalAlloc
MultiByteToWideChar
VirtualProtect
CreateThread
GetCurrentProcessId
GetPrivateProfileStringA
GetSystemDirectoryA
GetTickCount
WritePrivateProfileStringA
VirtualAlloc
VirtualFree
VirtualQuery
HeapCreate
GetSystemInfo
lstrcpyA
GetModuleFileNameA
InterlockedIncrement
LoadLibraryA
GetCommandLineA
Process32Next
TerminateProcess
OpenProcess
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
ReadProcessMemory
VirtualProtectEx
WriteProcessMemory
GetCurrentProcess
Module32Next
Module32First
lstrlenW
WideCharToMultiByte
IsBadReadPtr
OpenFileMappingA
CloseHandle
CreateFileMappingA
MapViewOfFile
lstrlenA
UnmapViewOfFile

user32

wsprintfA

advapi32

CryptCreateHash
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CryptAcquireContextA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CryptHashData

shlwapi

StrStrIA
StrStrW
StrStrA

msvcrt

??2@YAPAXI@Z
_stricmp
_memicmp
_adjust_fdiv
_initterm
isprint
strstr
sscanf
__CxxFrameHandler
sprintf
??3@YAXPAX@Z
_itoa
isspace
isalnum
free
malloc
atol
strrchr

Sections

.text
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

58fde0ef3721a7aff0acfbc0107ae5dd

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

msvcrt

Sections

.text Size: 32KB - Virtual size: 29KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 16KB - Virtual size: 31KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 32KB - Virtual size: 29KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 16KB - Virtual size: 31KB

.reloc
Size: 4KB - Virtual size: 3KB