b89c4a0c075ae7adb63e570a3d9aebf1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b89c4a0c075ae7adb63e570a3d9aebf1_JaffaCakes118
Size

47KB
MD5

b89c4a0c075ae7adb63e570a3d9aebf1
SHA1

d2af9d1efc06cca471a8a492f66f1f8973f5ccd8
SHA256

516b4f8bb5d44c53b4f23b38794c19b3f4ca78e9a968ef103202e8c294c300c7
SHA512

0bf45c06a6c30ed6b858a1facb2db70c5e765ec47f3b05665951cfdc0c5d98ac9153b891c93ac1f9d56d9615d2c4dec9b62bf9394b5530ec4c96b86a5edfabc3
SSDEEP

768:hhmi6RU6u/7tiI7EixFtB2+gd9GCtl+oAddWw8YfsTkSvOMamThhb8rjP/DC3k8:PP6WJ7tiiBClNsAYfEk/mlhyPW3k8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b89c4a0c075ae7adb63e570a3d9aebf1_JaffaCakes118

Files

b89c4a0c075ae7adb63e570a3d9aebf1_JaffaCakes118
.dll windows:4 windows x86 arch:x86

d0827a40bdc2c78e81b27583c18712d2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

SHRegDuplicateHKey

kernel32

GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
SetFilePointer
CreateFileA
FlushFileBuffers
SetStdHandle
VirtualQuery
InterlockedExchange
RtlUnwind
InitializeCriticalSection
GetCPInfo
GetOEMCP
GetACP
LoadLibraryA
VirtualAlloc
LeaveCriticalSection
EnterCriticalSection
CloseHandle
VirtualFree
HeapCreate
HeapDestroy
TlsAlloc
TlsGetValue
TlsSetValue
SetLastError
TlsFree
DeleteCriticalSection
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStdHandle
WriteFile
GetStringTypeW
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
GetLocalTime
GetCommandLineA
GetStartupInfoA
SetEndOfFile
GetLocaleInfoA
ReadFile
VirtualProtect
GetSystemInfo
lstrcpynA
lstrcmpA
OutputDebugStringA
GetWindowsDirectoryA
GetVersionExA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
CreateMutexA
lstrcmpiA
GetSystemDirectoryA
GetPrivateProfileStringA
LoadLibraryExA
GetProcAddress
FreeLibrary
GetPrivateProfileSectionA
lstrlenA
lstrcpyA
FindFirstFileA
FindClose
GetLastError
InterlockedDecrement
InterlockedExchangeAdd
Beep
GetModuleHandleA
GetProcessHeap

ole32

CoInitialize

advapi32

RegQueryValueExA
RegCloseKey
RegDeleteValueA
RegOpenKeyExA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

winmm

mmioInstallIOProcA

setupapi

SetupCloseInfFile
SetupFindNextLine
SetupGetLineTextA
SetupFindFirstLineA
SetupOpenInfFileA

Exports

Exports

wugbg

Sections

.code
Size: 41KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 622B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d0827a40bdc2c78e81b27583c18712d2

Headers

File Characteristics

Imports

shlwapi

kernel32

ole32

advapi32

version

winmm

setupapi

Exports

Exports

Sections

.code Size: 41KB - Virtual size: 70KB

.rdata Size: 3KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 776B

.reloc Size: 1024B - Virtual size: 622B

.code
Size: 41KB - Virtual size: 70KB

.rdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 776B

.reloc
Size: 1024B - Virtual size: 622B