dc5c57f6c97054fd7e439449133acd04_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

dc5c57f6c97054fd7e439449133acd04_JaffaCakes118
Size

280KB
MD5

dc5c57f6c97054fd7e439449133acd04
SHA1

73714baa21f12659e351bc78386dd3f69a89aa13
SHA256

0f2faced47f8f8295f97bc9c9d5795982a3f19805f238a9d2ff17763aa08fd10
SHA512

5cf42a4c3973ba205f187f4dcfad02af397670be0482c3a14accf36eca3e284b495ffe0c34997718744f618d5a581b6c17e71482a507e89eea14323775a6b14d
SSDEEP

6144:kGe9fgy53xXhFksVEozZfJ3SkoFIxgnrAOjJv7exj:kp9Y6BXhuRbFbrzC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dc5c57f6c97054fd7e439449133acd04_JaffaCakes118

Files

dc5c57f6c97054fd7e439449133acd04_JaffaCakes118
.dll windows:4 windows x86 arch:x86

c8ade6bbf50408caf87f7965b847c3d3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Documents and Settings\admin\Desktop\HoH Hook\Hl2\Release\PULICA.pdb

Imports

kernel32

GetProcAddress
GetModuleHandleA
GetCurrentProcess
WriteProcessMemory
VirtualProtect
Sleep
CreateThread
IsBadReadPtr
GetModuleFileNameA
WritePrivateProfileStringA
ExitProcess
GetPrivateProfileIntA
VirtualQuery
HeapAlloc
GetProcessHeap
CloseHandle
GetLocaleInfoW
FlushFileBuffers
GetSystemInfo
VirtualAlloc
SetStdHandle
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
RtlUnwind
GetLocalTime
GetCurrentThreadId
GetCommandLineA
GetVersionExA
TlsAlloc
SetLastError
GetLastError
TlsFree
TlsSetValue
TlsGetValue
TerminateProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteFile
LeaveCriticalSection
EnterCriticalSection
GetACP
GetOEMCP
GetCPInfo
SetUnhandledExceptionFilter
IsBadWritePtr
IsBadCodePtr
SetFilePointer
RaiseException
InitializeCriticalSection
InterlockedExchange
LoadLibraryA
LCMapStringA
MultiByteToWideChar
LCMapStringW
ReadFile

user32

FindWindowA
wsprintfA
GetAsyncKeyState
GetWindowTextA

shell32

ShellExecuteA

vstdlib

RandomFloat
Q_strncpy
Q_snprintf
KeyValuesSystem
Q_strnicmp
RandomSeed

tier0

?GetSubNode@CVProfNode@@QAEPAV1@PBDH0H@Z
?EnterScope@CVProfNode@@QAEXXZ
?ExitScope@CVProfNode@@QAE_NXZ
g_VProfCurrentProfile
g_pMemAlloc
GetCPUInformation
Msg
Error

Sections

.text
Size: 200KB - Virtual size: 197KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c8ade6bbf50408caf87f7965b847c3d3

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

vstdlib

tier0

Sections

.text Size: 200KB - Virtual size: 197KB

.rdata Size: 44KB - Virtual size: 41KB

.data Size: 12KB - Virtual size: 215KB

.reloc Size: 20KB - Virtual size: 18KB

.text
Size: 200KB - Virtual size: 197KB

.rdata
Size: 44KB - Virtual size: 41KB

.data
Size: 12KB - Virtual size: 215KB

.reloc
Size: 20KB - Virtual size: 18KB