b85bcdba2b9302f3503b8b3399a8b86e_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

b85bcdba2b9302f3503b8b3399a8b86e_JaffaCakes118
Size

24KB
MD5

b85bcdba2b9302f3503b8b3399a8b86e
SHA1

fcef12b3df7bc7c8bd68fa8c2f644be92cc4f063
SHA256

8d62c9f600efebd409ee71caa6edbdc400d41e7e6515bfd8383e97130ed0162f
SHA512

5bd83482c3ec490c92d5c06826ca9e233d40b13270ce1fe52122aa7372c6dc82629ef1298e81fbd9c8c2876c0eb6eb21f5ed51b5f71ebb7b489f69ef4b1b91a4
SSDEEP

384:mT4RYW9u1mEwIeRHcFGLLQ3fgjugdprUT5C6XpXTHIsP5ejPOdDK0vAilJ:GCcoExMcFGvkdJ5VBHAyVK0zl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b85bcdba2b9302f3503b8b3399a8b86e_JaffaCakes118

Files

b85bcdba2b9302f3503b8b3399a8b86e_JaffaCakes118
.dll windows:4 windows x86 arch:x86

a00b8e23f0fac0639025cefada3497e5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenA
GetFileSize
lstrcatA
LocalFree
GetLastError
GetVersionExA
GlobalFree
GlobalAlloc
HeapFree
HeapAlloc
GetProcessHeap
SearchPathA
DeleteFileA
GetModuleFileNameA
GetProcessTimes
lstrcpyA
GetSystemDirectoryA
Process32Next
Process32First
CreateToolhelp32Snapshot
VirtualFreeEx
WaitForSingleObject
WriteProcessMemory
VirtualAllocEx
CreateRemoteThread
DuplicateHandle
GetCurrentProcess
VirtualProtectEx
lstrcmpiA
CreateThread
CloseHandle
GetTempPathA
GetTickCount
FindFirstFileA
CreateFileA
WriteFile
ReadFile
OpenProcess
GetCurrentProcessId
CreateMutexA
ReleaseMutex
GetFileAttributesA
Sleep
FreeLibrary
LoadLibraryA
GetProcAddress

user32

wsprintfA
GetWindowTextA
GetForegroundWindow

gdi32

GetDeviceCaps
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteObject
DeleteDC
CreateDCA

advapi32

LookupPrivilegeValueA
SetSecurityInfo
SetEntriesInAclA
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges

shell32

ShellExecuteA

msvcrt

strlen
memset
strcpy
strtok
mbstowcs
strcat
strrchr
strstr
malloc
??2@YAPAXI@Z
sprintf
printf
_strlwr
wcscmp
_stricmp
memcpy

msvcp60

?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

wininet

InternetWriteFile
HttpSendRequestExA
HttpEndRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetReadFile
HttpSendRequestA
InternetCrackUrlA
InternetCloseHandle
HttpAddRequestHeadersA

Exports

Exports

Install

Sections

.bss
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a00b8e23f0fac0639025cefada3497e5

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

msvcrt

msvcp60

wininet

Exports

Exports

Sections

.bss Size: - Virtual size: 5KB

.data Size: 21KB - Virtual size: 20KB

.reloc Size: 2KB - Virtual size: 1KB

.bss
Size: - Virtual size: 5KB

.data
Size: 21KB - Virtual size: 20KB

.reloc
Size: 2KB - Virtual size: 1KB