d6e1aab83b14237dcadb53374010d32b_JaffaCakes118

General

Target

d6e1aab83b14237dcadb53374010d32b_JaffaCakes118
Size

21KB
MD5

d6e1aab83b14237dcadb53374010d32b
SHA1

7e782982cce7ebd2f3ea53b280a09299209c21df
SHA256

5bd9464332b46306ebc7d7964c01dd33c5469ff459999575540e9438b4b87b04
SHA512

cddf731d3271eb1ad6e96b942995013d30b54a552e6255543894cf81307eaa9b2e82a0a8373845615b2922bfcb33d0a280269ce3d4476d951cbc7020b3d2b48a
SSDEEP

384:hB6P4s3vvOo6L0BqwvMO+Rdp9h7yPz6tqran+o9LW3Z:P63XOo6L8FMO+Rdpnmzeqo+o9L0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d6e1aab83b14237dcadb53374010d32b_JaffaCakes118

Files

d6e1aab83b14237dcadb53374010d32b_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b5bee813d5f7c091d8a2d0eee83eaef3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
MultiByteToWideChar
WriteFile
CloseHandle
ReadFile
GetFileSize
CreateFileA
FindNextFileA
FindFirstFileA
Process32Next
Sleep
Process32First
CreateToolhelp32Snapshot
GetFullPathNameA
SetCurrentDirectoryA
MoveFileA
GlobalFree
WritePrivateProfileStringA
ExitProcess
WinExec
GetCurrentDirectoryA
ExitThread
OpenMutexA
TerminateProcess
CreateProcessA
GetStartupInfoA
CreatePipe
CreateThread
CreateMutexA
RtlUnwind
GetStringTypeW
GetStringTypeA
GetEnvironmentVariableA
lstrcatA
LoadLibraryA
GetPrivateProfileStringA
GetProcAddress
GetModuleFileNameA
lstrcpyA
lstrcmpA
GetComputerNameA
DeleteFileA
lstrlenA

user32

IsWindowVisible
EnumWindows
GetWindowTextA

gdi32

CreateDCA
GetDeviceCaps
CreateDIBSection
DeleteDC
SaveDC
SelectObject
BitBlt
RestoreDC
DeleteObject
CreateCompatibleDC

ws2_32

WSAStartup
recv
socket
gethostbyname
htons
connect
send
gethostbyaddr
closesocket
inet_addr

wininet

InternetOpenA
InternetConnectA
InternetCloseHandle
FtpGetFileA
FtpPutFileA

gdiplus

GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusShutdown
GdipSaveImageToFile
GdipCreateBitmapFromHBITMAP
GdiplusStartup

Exports

Exports

RunMain

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b5bee813d5f7c091d8a2d0eee83eaef3

Headers

File Characteristics

Imports

kernel32

user32

gdi32

ws2_32

wininet

gdiplus

Exports

Exports

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 1KB - Virtual size: 3KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1KB - Virtual size: 3KB

.reloc
Size: 1KB - Virtual size: 1KB