b88e4f6a85a664e3634dea03be72ea49_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b88e4f6a85a664e3634dea03be72ea49_JaffaCakes118
Size

48KB
MD5

b88e4f6a85a664e3634dea03be72ea49
SHA1

154e3b17c13e0575e29a67399c2b884a5e53e2a4
SHA256

b875f68697495d127fdf9fc1f373ebb94d9fe72d77f0ed01b060ba91f5ac01e2
SHA512

d736d8e1bd8b62bbe75340a6af85545ca49ec8188afc6ba74c993d0aafbb28e7c00bc81a80a2c8851ccf708b50ab494d358a8585ab2a3fb08d4a6e3f7d4db0b6
SSDEEP

768:vD1zQwsJsSTZWp6dumJWpouB+0OP+g0TpcUfyzUF6F05I7/iC3bXzEQJX7C8+5dK:VsJn8d8WSrNUpceyzU00Y/DLHXenV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b88e4f6a85a664e3634dea03be72ea49_JaffaCakes118

Files

b88e4f6a85a664e3634dea03be72ea49_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

d2a4ca6d8a6fa40c7ded02d33d3b1585

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

InterlockedDecrement
HeapDestroy
lstrlenW
GetShortPathNameA
GetModuleHandleA
GetCommandLineW
WideCharToMultiByte
CreateThread
LocalFree
InterlockedIncrement
MoveFileA
DeleteFileA
SetFileAttributesA
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
GetCurrentProcessId
Process32Next
Process32First
RemoveDirectoryA
GetExitCodeProcess
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
ExitProcess
LoadLibraryA
FreeLibrary
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
CloseHandle
Sleep
lstrlenA
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
CreateDirectoryA
WritePrivateProfileStringA
GetProcAddress

advapi32

SetNamedSecurityInfoA
GetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA

shell32

SHGetSpecialFolderPathA
CommandLineToArgvW

ole32

CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitialize
CoCreateInstance

oleaut32

SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString

msvcrt

atoi
_strupr
_strlwr
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
_wcslwr
wcsstr
memcmp
??2@YAPAXI@Z
_access
strcat
??3@YAXPAX@Z
sprintf
strncpy
strchr
memset
strncmp
strlen
strcpy
_stricmp
strstr
strcmp
strrchr
memcpy
_purecall

shlwapi

SHSetValueA
SHDeleteValueA
SHDeleteKeyA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

idata
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d2a4ca6d8a6fa40c7ded02d33d3b1585

Headers

File Characteristics

Imports

kernel32

advapi32

shell32

ole32

oleaut32

msvcrt

shlwapi

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 4KB

idata Size: 4KB - Virtual size: 4B

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 4KB

idata
Size: 4KB - Virtual size: 4B

.reloc
Size: 4KB - Virtual size: 2KB