da89e78033a2a78cd4f618cfbd720344_JaffaCakes118

General

Target

da89e78033a2a78cd4f618cfbd720344_JaffaCakes118
Size

25KB
MD5

da89e78033a2a78cd4f618cfbd720344
SHA1

62725e9f833903ab1395b8d4117d9aa21d4d9a45
SHA256

8edd47b54d64341d9c9dfb6cb8499bfcaf7d986df3391375d104bf1468474315
SHA512

2e0bbd292a00ae61506bc56c54f291b9e9c5f17953579d1dc9062abccbebd04265c51ff77e50f71610c29e09e14641d95a4300e57c304d60dbe5283934327927
SSDEEP

768:SDdhdeHtGmJbaI8eKdUv9l6U2tZogfL1cGWbVY:KtiGmJbaI2pcB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da89e78033a2a78cd4f618cfbd720344_JaffaCakes118

Files

da89e78033a2a78cd4f618cfbd720344_JaffaCakes118
.dll windows:4 windows x86 arch:x86

0d81dd231c4303ed11888301caa9f13e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
Sleep
InitializeCriticalSection
TerminateProcess
TerminateThread
IsBadReadPtr
GetPrivateProfileStringA
RaiseException
CloseHandle
WideCharToMultiByte
ReadProcessMemory
SetThreadContext
GetCurrentThread
GlobalLock
Process32Next
Process32First
CreateToolhelp32Snapshot
WriteProcessMemory
GlobalUnlock
GlobalFree
EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
GetProcAddress
GetCurrentProcess
VirtualProtectEx
GetModuleFileNameA
CreateThread
GetCurrentProcessId
OpenMutexA
SetUnhandledExceptionFilter
CreateMutexA

user32

FindWindowA
GetWindowThreadProcessId
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx

ws2_32

WSASetLastError

wininet

InternetOpenA
InternetCloseHandle
InternetReadFile
InternetOpenUrlA

msvcrt

??3@YAXPAX@Z
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
wcslen
fopen
fread
fclose
strcat
sprintf
strcpy
strrchr
memcpy
atoi
strchr
memset
??2@YAPAXI@Z
strncpy
_strlwr
sscanf
strlen
strstr

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdata
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0d81dd231c4303ed11888301caa9f13e

Headers

File Characteristics

Imports

kernel32

user32

ws2_32

wininet

msvcrt

Sections

.text Size: 17KB - Virtual size: 16KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 2KB - Virtual size: 4KB

sdata Size: 512B - Virtual size: 80B

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 17KB - Virtual size: 16KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 2KB - Virtual size: 4KB

sdata
Size: 512B - Virtual size: 80B

.reloc
Size: 3KB - Virtual size: 2KB