dde98cf15b146f1bd90b9472e1152cd1_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

dde98cf15b146f1bd90b9472e1152cd1_JaffaCakes118
Size

23KB
MD5

dde98cf15b146f1bd90b9472e1152cd1
SHA1

6ace82ec07e0ac2f8d545be9a0f2bb29f0d89f29
SHA256

001276aabe98051c4e977b7a45fc1bfc6e0734db385c39dd02b4016799143419
SHA512

10e6562898516a6d673c1cf4cc5d77e5c12a25545f48365cdf198df390d68b8d78a0b0e62a768bcaf15b99b582961b0623a362fe63915ed1d7add55cf6a94077
SSDEEP

384:O7gSNNE7aifxdjgitp0aLXmlZCCADMQRtt+ed933PHb1rS7ef9+7BN:O7XNNEp5dj3ptTmnCflR33PZO7T7z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dde98cf15b146f1bd90b9472e1152cd1_JaffaCakes118

Files

dde98cf15b146f1bd90b9472e1152cd1_JaffaCakes118
.dll windows:4 windows x86 arch:x86

3d2cc0507b1446a0692809b9f4c72279

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibraryAndExitThread
SetThreadPriority
GetCurrentThread
ReleaseMutex
FreeLibrary
Sleep
GetCurrentProcessId
SetEvent
CreateMutexA
CreateThread
GetModuleFileNameA
DisableThreadLibraryCalls
VirtualFree
VirtualProtect
VirtualAlloc
Process32Next
Process32First
CreateEventA
Module32Next
Module32First
VirtualQuery
GetSystemInfo
GetPrivateProfileStringA
GetProcAddress
GetCurrentProcess
WinExec
WriteFile
CreateFileA
GetTempFileNameA
GetShortPathNameA
GetTempPathA
InterlockedPopEntrySList
InterlockedPushEntrySList
InitializeSListHead
CreateFileMappingA
WaitForSingleObject
ResetEvent
GetModuleHandleA
LoadLibraryA
OpenEventA
MapViewOfFile
UnmapViewOfFile
CloseHandle
CreateToolhelp32Snapshot

user32

UnhookWindowsHookEx
SetWindowsHookExA
ShowWindow
UpdateWindow
CreateWindowExA
RegisterClassA
EnumDesktopWindows
GetWindowTextA
GetClassNameA
GetWindowThreadProcessId
CallNextHookEx

advapi32

RegEnumValueA
RegOpenKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegCloseKey

msvcp60

?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

wininet

DeleteUrlCacheEntry
InternetCloseHandle
InternetReadFile
HttpSendRequestA
HttpAddRequestHeadersA
InternetCrackUrlA
InternetOpenA
InternetConnectA
HttpOpenRequestA

urlmon

URLDownloadToFileA

ws2_32

setsockopt
WSACleanup
closesocket

msvcrt

_ismbcprint
_mbscmp
_mbsupr
time
_mbsnbcpy
_mbsstr
_snprintf
strlen
_memicmp
__CxxFrameHandler
memset
_adjust_fdiv
malloc
_initterm
_onexit
__dllonexit
free
_ismbcspace
_mbsinc
memmove
abs
memcmp
difftime
sprintf
_mbsrchr
_local_unwind2
_except_handler3
memcpy
??2@YAPAXI@Z
_mbsicmp
strcat
strcpy

netapi32

Netbios

Exports

Exports

_DllMain@12

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3d2cc0507b1446a0692809b9f4c72279

Headers

File Characteristics

Imports

kernel32

user32

advapi32

msvcp60

wininet

urlmon

ws2_32

msvcrt

netapi32

Exports

Exports

Sections

.text Size: 21KB - Virtual size: 20KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 21KB - Virtual size: 20KB

.reloc
Size: 1KB - Virtual size: 1KB