d5e8bd35c9efc6d15d2f45446a01c7e9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d5e8bd35c9efc6d15d2f45446a01c7e9_JaffaCakes118
Size

136KB
MD5

d5e8bd35c9efc6d15d2f45446a01c7e9
SHA1

86f486938bc6c352e3c90b6fd58447042ac85977
SHA256

708cd28507422f6ea004d07e4aeedd21e22cd1f96a8d5620a43bb623e5ae9bea
SHA512

1372d1ad8e3289243f12b0ac51dd108db984d22bb2d3f9111e49279728454626bb741fe71574a6dfe55f83f5256d2d61e0fb5be295c67416a054fce07381afc0
SSDEEP

3072:Y/n6DMRV9YNT3Wn9TWablfmDALsRaUFYaJ8qHWFcltO54fZ8DU:EiqojW9T1LsRrKRqHdltLfyD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d5e8bd35c9efc6d15d2f45446a01c7e9_JaffaCakes118

Files

d5e8bd35c9efc6d15d2f45446a01c7e9_JaffaCakes118
.dll windows:4 windows x86 arch:x86

55da0dd8acda3ae8966a70c284ff9383

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReadFile
WriteFile
CreateFileA
DeviceIoControl
GlobalAlloc
GlobalFree
ReleaseMutex
EnterCriticalSection
LeaveCriticalSection
GetLastError
GetCurrentThread
GetThreadPriority
SetThreadPriority
Sleep
GetVersionExA
ResetEvent
WaitForSingleObject
CloseHandle
DisableThreadLibraryCalls
HeapDestroy
FreeLibrary
WaitForMultipleObjects
SetEvent
HeapFree
HeapAlloc
RaiseException
SetLastError
CompareStringW
WideCharToMultiByte
LocalAlloc
LocalFree
InterlockedCompareExchange
InitializeCriticalSection
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetProcAddress
LoadLibraryA
MultiByteToWideChar
CreateEventA
VirtualProtect

user32

wsprintfA
GetParent
GetWindowRect
GetDesktopWindow
MoveWindow

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegOpenKeyA

ole32

CoCreateInstance

rpcrt4

RpcBindingInqAuthInfoA
RpcSsDestroyClientContext
RpcBindingFree
UuidFromStringW
NdrClientCall2
NDRCContextBinding

msvcrt

wcschr
_onexit
__dllonexit
wcscmp
asctime
ctime
clock
difftime
localtime
time
_except_handler3
malloc
isupper
tolower
memset
memcpy
strstr
_adjust_fdiv
_initterm
_beginthread
swprintf
sprintf
_wcsicmp
_itow
wcsncpy
wcsncat
wcstoul
memchr
_ltow
iswdigit
wcsncmp
towlower
iswxdigit
wcstol
swscanf
wcslen
free
wcscat
_getpid
wcscpy

msvcp60

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ

Sections

.text
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

55da0dd8acda3ae8966a70c284ff9383

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

rpcrt4

msvcrt

msvcp60

Sections

.text Size: 87KB - Virtual size: 86KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 35KB - Virtual size: 69KB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 87KB - Virtual size: 86KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 35KB - Virtual size: 69KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 3KB - Virtual size: 2KB