c200313eae45ec4c2d802d8b912eb0e5_JaffaCakes118

General

Target

c200313eae45ec4c2d802d8b912eb0e5_JaffaCakes118
Size

20KB
MD5

c200313eae45ec4c2d802d8b912eb0e5
SHA1

899ad6921da411f2be0026a62fffa69a0b5c8aca
SHA256

753c5c8a28a43bc7c352505bc558aa50822ef032fbbc017abdaa393cb8dc17db
SHA512

d4e55fef50554b1ffa339b3b172e3c705efd958821d3e27aedd870d13e3dfe6628614e4ebbe385e49fda021c963e39003c76b116eb63221e2571e84234cdfe6b
SSDEEP

384:yp+nPcfDLilOJxmqirBb2CwFdpWTHHHyHZCjVbBm:yKkDLPJyrBb2CwFdpWTHnyHw4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c200313eae45ec4c2d802d8b912eb0e5_JaffaCakes118

Files

c200313eae45ec4c2d802d8b912eb0e5_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b561bbd49c231e46109d157eddf97d37

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
GetFileSize
CreateFileA
WriteFile
MultiByteToWideChar
FindClose
FindFirstFileA
GetModuleFileNameA
GetTempPathA
GetWindowsDirectoryA
FindNextFileA
DeleteFileA
ReadFile
GetCurrentProcess
TerminateProcess
CreateThread
Sleep
GetTickCount
CopyFileA
lstrcatA
lstrcpyA
LocalAlloc
lstrcmpiA
LoadLibraryA
GetProcAddress

user32

UnregisterClassA
LoadCursorA
RegisterClassExA
GetKeyboardLayout
GetKeyboardLayoutList
MessageBoxA
SystemParametersInfoA

advapi32

RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

imm32

ImmIsIME

msvcrt

_except_handler3
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
strstr
strcpy
atoi
_strlwr
strrchr
strlen
_stricmp
sprintf
memset
strcat

Exports

Exports

CandWndProc
CompWndProc
IMEClearPubString
IMESetPubString
ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME
StatusWndProc
UIWndProc
pfjieaoidjglkajd

Sections

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b561bbd49c231e46109d157eddf97d37

Headers

File Characteristics

Imports

kernel32

user32

advapi32

imm32

msvcrt

Exports

Exports

Sections

.bss Size: - Virtual size: 1KB

.data Size: 8KB - Virtual size: 7KB

.rsrc Size: 1024B - Virtual size: 816B

.reloc Size: 1024B - Virtual size: 808B

.bss
Size: - Virtual size: 1KB

.data
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 1024B - Virtual size: 816B

.reloc
Size: 1024B - Virtual size: 808B