d1319a4c47f1629ac7b5ef45f2db1d24_JaffaCakes118

General

Target

d1319a4c47f1629ac7b5ef45f2db1d24_JaffaCakes118
Size

228KB
MD5

d1319a4c47f1629ac7b5ef45f2db1d24
SHA1

7ac60641970bef9c180fadac458c24d875ed52a3
SHA256

17cb4a7fd169213a503a14b759554e969e77cd2b58a45b4e1b3603eb804b7aea
SHA512

ae9bdec180e92b73594b8ed5b4ea41309bac566f2b16e3ca93a2a0eb8ec64087b65873cf37f836eff1c02110a4d332b97007ec234b4bf89f91281214310b8b63
SSDEEP

6144:JLxbizYRwjjzHhs+Sh3xrdBnEIZ7e5nZE:lxbTR6Dh2hh9E2in

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d1319a4c47f1629ac7b5ef45f2db1d24_JaffaCakes118

Files

d1319a4c47f1629ac7b5ef45f2db1d24_JaffaCakes118
.dll windows:4 windows x86 arch:x86

819dc8958406645f8505e67db6095c5e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CompareStringA
CreateEventA
CreateThread
DeleteFileA
ExitProcess
GetACP
GetCommandLineA
GetConsoleCP
GetEnvironmentVariableA
GetFileTime
GetModuleHandleA
GetProcAddress
GetStringTypeW
GetThreadContext
GetTimeFormatA
GetVersionExA
GlobalLock
GlobalReAlloc
HeapAlloc
HeapCreate
InterlockedDecrement
InterlockedIncrement
IsValidCodePage
LeaveCriticalSection
LocalFree
OpenEventA
QueryPerformanceCounter
RaiseException
ResumeThread
RtlUnwind
SearchPathA
SetErrorMode
SetProcessWorkingSetSize
WriteFile
lstrcatA
lstrcpynA

advapi32

CreatePrivateObjectSecurity
CreateServiceA
EnumDependentServicesW
RegEnumKeyExW
RegReplaceKeyA
RegRestoreKeyA
RegisterServiceCtrlHandlerExA
SetPrivateObjectSecurity

user32

SetDlgItemTextA
GetDlgCtrlID
KillTimer
IsWindowVisible
InvalidateRect
GetWindow
GetWindowPlacement
WindowFromPoint
GetClassLongA
DialogBoxIndirectParamA
DefWindowProcA
DefDlgProcA
CreateWindowExA
CreatePopupMenu
BeginPaint
SetWindowTextA
wsprintfA

ole32

CoQueryReleaseObject
IsEqualGUID
CoGetCurrentProcess
CoFreeLibrary

ddraw

GetDDSurfaceLocal
DirectDrawEnumerateW
DirectDrawCreateEx
DirectDrawCreate
DSoundHelp
DDInternalUnlock
DDInternalLock
GetSurfaceFromDC

Exports

Exports

EnumDriveModeRelease

Sections

.text
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 92KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

819dc8958406645f8505e67db6095c5e

Headers

File Characteristics

Imports

kernel32

advapi32

user32

ole32

ddraw

Exports

Exports

Sections

.text Size: 120KB - Virtual size: 120KB

.data Size: 92KB - Virtual size: 160KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 120KB - Virtual size: 120KB

.data
Size: 92KB - Virtual size: 160KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 4KB - Virtual size: 4KB