b911781637a3613d0a88b8cef81e920d_JaffaCakes118

General

Target

b911781637a3613d0a88b8cef81e920d_JaffaCakes118
Size

18KB
MD5

b911781637a3613d0a88b8cef81e920d
SHA1

e15868db6ba31264b7eb0bb25631eeebf3a1082f
SHA256

edef191cacedc168ebd7ac2a737481716f29ca5333b0c922a745e44baf72e870
SHA512

4a02435455911489b5d17ac57f707a60c0db52afb4417140c58977546b20b1a35938f2071b8c344e3a63618df17178b552faece54b2965f79d18d4ba06b46cd8
SSDEEP

192:c3fS2iFV8HvvhX4FmI/TWL7bOm5Oo4nz/7MH/kCThft1amg0j2w:BVUJ8mI/C3INk8+FUmg0S

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b911781637a3613d0a88b8cef81e920d_JaffaCakes118

Files

b911781637a3613d0a88b8cef81e920d_JaffaCakes118
.dll windows:4 windows x86 arch:x86

ea45098c20ee7c6b27ea8a8ddc71518c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetProcAddress
GetModuleHandleA
FindClose
FindNextFileA
lstrcpynA
lstrcmpA
FindFirstFileA
VirtualProtectEx
LoadLibraryA
Module32Next
Module32First
ReadFile
GetLastError
OpenProcess
WinExec
TerminateProcess
ExitProcess
SuspendThread
OpenThread
GetCurrentProcess
ReleaseMutex
GetSystemDirectoryA
CreateToolhelp32Snapshot
Process32First
lstrcmpiA
Process32Next
lstrlenA
CreateFileA
WriteFile
GetTempPathA
lstrcpyA
Sleep
CreateMutexA
CreateThread
CloseHandle
GetModuleFileNameA
GetCurrentProcessId

user32

MessageBoxA
SetProcessWindowStation
OpenDesktopA
SetThreadDesktop
EnumWindows
OpenWindowStationA
GetWindowThreadProcessId

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

shlwapi

StrStrIA

msvcrt

strlen
sprintf
strcat
strncat
_purecall
strcmp
_itoa
memcpy
strstr
memset
??2@YAPAXI@Z
??3@YAXPAX@Z
strcpy
strncpy

wininet

InternetCloseHandle

Sections

.bss
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 1024B - Virtual size: 532B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ea45098c20ee7c6b27ea8a8ddc71518c

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

msvcrt

wininet

Sections

.bss Size: - Virtual size: 17KB

.data Size: 14KB - Virtual size: 14KB

.shared Size: 1024B - Virtual size: 532B

.reloc Size: 2KB - Virtual size: 1KB

.bss
Size: - Virtual size: 17KB

.data
Size: 14KB - Virtual size: 14KB

.shared
Size: 1024B - Virtual size: 532B

.reloc
Size: 2KB - Virtual size: 1KB