d49e2ad60ad0874b752cb527d5474cba_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d49e2ad60ad0874b752cb527d5474cba_JaffaCakes118
Size

18KB
MD5

d49e2ad60ad0874b752cb527d5474cba
SHA1

063fbec5a378c45820f5c4a27f0dbd5e5e5c9dac
SHA256

eb66ccb5999675b28af48b39661b6fc5434f04c39bd66009a97c673d45f0e511
SHA512

07fde29838071968fa19b706b388bdc56c4ffde91e3173140f694741400d7f0792d1bba11da93e036910b215f3971dda5c921ecb1dff5f9c22281dd9b1540c9a
SSDEEP

384:A2B1Ga3nEtrKxOsWMu8Y96C8tfH0gdPrkLHU6VFTH:AG3n8mxUMntt1kLHN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d49e2ad60ad0874b752cb527d5474cba_JaffaCakes118

Files

d49e2ad60ad0874b752cb527d5474cba_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b6ef357a42fe09f2ddf4fdf85c2f3bff

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wsock32

htons
inet_addr
gethostbyname
recv
inet_ntoa
WSAStartup
ioctlsocket
send
socket
connect
WSACleanup
closesocket

user32

SetClipboardData
CloseClipboard
keybd_event
SetFocus
EmptyClipboard
OpenClipboard
VkKeyScanA
SetForegroundWindow
wsprintfA
BlockInput
ShowWindow

advapi32

EnumServicesStatusA
CloseServiceHandle
OpenProcessToken
ImpersonateLoggedOnUser
OpenSCManagerA

wininet

InternetOpenUrlA
InternetOpenA
InternetReadFile

msvcrt

fopen
_onexit
__dllonexit
sprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
rand
srand
strstr
strncpy
malloc
time
fclose
fwrite
strtok
atoi
free
_initterm
_adjust_fdiv

ole32

CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

SysFreeString
SysAllocString
VariantClear
VariantInit

psapi

GetModuleBaseNameA
EnumProcesses
EnumProcessModules

kernel32

CreateFileA
CreateThread
CreateProcessA
LoadLibraryA
GetProcAddress
lstrcpyA
lstrlenA
lstrcmpA
lstrcpynA
CreateMutexA
GlobalUnlock
OpenProcess
lstrcmpiA
GetLocaleInfoA
Sleep
GetTickCount
InterlockedDecrement
GetWindowsDirectoryA
GlobalAlloc
DisableThreadLibraryCalls
MultiByteToWideChar
GetLastError
CloseHandle
GlobalLock

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 894B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b6ef357a42fe09f2ddf4fdf85c2f3bff

Headers

File Characteristics

Imports

wsock32

user32

advapi32

wininet

msvcrt

ole32

oleaut32

psapi

kernel32

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 3KB - Virtual size: 2KB

.reloc Size: 1024B - Virtual size: 894B

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 3KB - Virtual size: 2KB

.reloc
Size: 1024B - Virtual size: 894B