cfb3238fa2ad6785ab70d1f2ebd194d9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

cfb3238fa2ad6785ab70d1f2ebd194d9_JaffaCakes118
Size

19KB
MD5

cfb3238fa2ad6785ab70d1f2ebd194d9
SHA1

f32bc61c161978fcc9c9549c2fe42b328af42715
SHA256

ef448a86fb839b225841cbb21bf6a3281bbb2e3320ee58d6d4d4bdaef6769999
SHA512

9d73bf5a403a7db9037be705c0ec943a4c20dc646c821aab966545146f427363d36c815cd01a465826345e90bea8a9ecb654f9344244ddd697a9cc8c26e8826f
SSDEEP

384:pyUc72Fd+i2nBp77PFlggsoDCDoCkW+aN6CR3gfJ6Is:gJMsnvrn0doCSS5R3gfw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cfb3238fa2ad6785ab70d1f2ebd194d9_JaffaCakes118

Files

cfb3238fa2ad6785ab70d1f2ebd194d9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1820cd82c2275c403b46f1f80b496215

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Projects\Копия DKLogger2\release\DKLogger2.pdb

Imports

kernel32

GetLastError
CreateThread
GlobalLock
GetSystemDirectoryA
GlobalUnlock
GetCurrentThreadId
GetModuleHandleA
IsBadReadPtr
HeapReAlloc
Sleep
lstrlenA
DeleteFileA
SetCurrentDirectoryA
FindFirstFileA
lstrcmpA
lstrcatA
FindNextFileA
FindClose
GlobalFree
CreateMutexA
GetLogicalDriveStringsA
GetComputerNameA
SetFilePointer
GetModuleFileNameA
GetWindowsDirectoryA
CopyFileA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
WriteFile
lstrcpyA
SetLastError
GlobalAlloc
CreateFileA
HeapFree
ReadFile
CloseHandle
GetProcessHeap
HeapAlloc
GetFileSize
GetSystemTime

user32

GetClipboardData
CloseClipboard
GetForegroundWindow
GetWindowTextA
GetWindowThreadProcessId
GetKeyboardLayout
AttachThreadInput
wsprintfA
UnhookWindowsHookEx
SetWindowsHookExA
ToAsciiEx
OpenClipboard
ChangeClipboardChain
EndPaint
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
RegisterClassExA
GetKeyboardState
CreateWindowExA
ShowWindow
UpdateWindow
SetClipboardViewer
DestroyWindow
SendMessageA
CallNextHookEx
PostQuitMessage
BeginPaint
DefWindowProcA

advapi32

RegEnumKeyExA
RegCloseKey
RegQueryValueExA
RegSetValueExA
GetUserNameA
RegOpenKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
RegOpenKeyA

msvcr80

__p__fmode
_strlwr
_ltoa
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
_crt_debugger_hook
__set_app_type
_encode_pointer
memset
__p__commode
??2@YAPAXI@Z
??3@YAXPAX@Z
strncpy
fopen
fwrite
fclose
_localtime64
_time64
asctime_s
strchr
sscanf
atol
strncmp
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv

wininet

InternetGetConnectedState

dnsapi

DnsQuery_A

ws2_32

send
WSACleanup
closesocket
recv
inet_addr
htons
socket
WSAStartup
gethostbyname
connect

shlwapi

PathFileExistsA
PathRemoveFileSpecA

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1820cd82c2275c403b46f1f80b496215

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

msvcr80

wininet

dnsapi

ws2_32

shlwapi

Sections

.text Size: 11KB - Virtual size: 11KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 428B

.text
Size: 11KB - Virtual size: 11KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 428B