c75e6321cbc58ccd2d88ada14429c501_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c75e6321cbc58ccd2d88ada14429c501_JaffaCakes118
Size

56KB
MD5

c75e6321cbc58ccd2d88ada14429c501
SHA1

a661bcd80ef5e7e68d7ac5eecc656e1493418408
SHA256

22ae5ae05e4606e5cb5f0bdca6b3162cc20c80b23ac6cdf365bda9964d76d593
SHA512

14038e78e81247f5137f4acff0d11644f45584d4c1ecc0deb0107d6bfb694f1e9ac8372e0ba16f3ef3b124d3cba29839d652f9eaa2a5d596f7050041692e5972
SSDEEP

768:Y4e4i+AVWLyqoeMxFSk0I9ELe1LMrS3b6cTEmEmhDKRr2K88:c+AVW//MxFSHyELe1LiSnx9DKR9N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c75e6321cbc58ccd2d88ada14429c501_JaffaCakes118

Files

c75e6321cbc58ccd2d88ada14429c501_JaffaCakes118
.dll windows:4 windows x86 arch:x86

9278ea880a823e435f0f7e25533e5734

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

h:\征途工程\钩子\Dll\Release\DLL.pdb

Imports

imm32

ImmGetCompositionStringA
ImmGetContext
ImmReleaseContext

user32

MessageBoxA
GetWindowTextA
ScreenToClient
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx

ws2_32

send
closesocket
connect
htons
gethostbyname
socket
WSAStartup
WSACleanup

kernel32

GetSystemInfo
VirtualProtect
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
GetLocaleInfoA
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCommandLineA
GetVersionExA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
HeapFree
GetLastError
CloseHandle
WriteFile
HeapReAlloc
HeapAlloc
HeapSize
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
InitializeCriticalSection
RtlUnwind
InterlockedExchange
VirtualQuery
LoadLibraryA
VirtualAlloc
SetStdHandle
FlushFileBuffers
SetFilePointer
GetACP
GetOEMCP
GetCPInfo

Exports

Exports

StartHook
StopHook

Sections

.text
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BUG
Size: 4KB - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9278ea880a823e435f0f7e25533e5734

Headers

File Characteristics

PDB Paths

Imports

imm32

user32

ws2_32

kernel32

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 28KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 11KB

BUG Size: 4KB - Virtual size: 28B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 32KB - Virtual size: 28KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 11KB

BUG
Size: 4KB - Virtual size: 28B

.reloc
Size: 4KB - Virtual size: 3KB