df9b6875c99c389a8e2f3ede12752d3b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

df9b6875c99c389a8e2f3ede12752d3b_JaffaCakes118
Size

164KB
MD5

df9b6875c99c389a8e2f3ede12752d3b
SHA1

a44f255d3c4c9168315cae3d5f2f1083e1c4914e
SHA256

891020a524611a76461db8243a6f7549169e949fca0dafa3982e013b5a373d48
SHA512

d6af21e239a6de6758bbe55191a46af0306310a0fc0bbc8a1ce24d50f80ad189d5b3d61caedcfbf0cccadb544f704c34b9759a21d56eca9a8478b513f8a35679
SSDEEP

3072:Z2ujDQmGWfDI1S4dB4kDcgOJfu8p1C9MqqDLy/nWy:Z28qtS4AJG0xqqDLunl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df9b6875c99c389a8e2f3ede12752d3b_JaffaCakes118

Files

df9b6875c99c389a8e2f3ede12752d3b_JaffaCakes118
.dll windows:4 windows x86 arch:x86

10aca761f92181952653511fd51c4f9d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
GetTempFileNameA
GetTempPathA
GetCurrentProcessId
FreeLibrary
LoadResource
GlobalAlloc
GlobalUnlock
FindResourceA
CloseHandle
GetProcAddress
LoadLibraryA
lstrcpyA
UnmapViewOfFile
lstrcatA
CreateFileA
LockResource
GlobalFree
GlobalLock
SetFilePointer
InterlockedCompareExchange
SizeofResource
FreeResource
DeleteFileA
LocalReAlloc
LocalSize
GetTickCount
FormatMessageW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
lstrlenW
LocalAlloc
LocalFree
GetFileAttributesW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
GetModuleFileNameW
InterlockedExchange
GetCommandLineA
ReadFile
VirtualProtect

user32

CharNextW
GetDlgItem
SendMessageW
EnableWindow
GetParent
UpdateWindow
InvalidateRect
SetWindowTextW
wsprintfA
LoadStringW
GetFocus
IsWindowEnabled
CharUpperW
DeferWindowPos
MapWindowPoints
GetWindowRect
EndDeferWindowPos
BeginDeferWindowPos
CharUpperBuffW
CharLowerW
IntersectRect
OffsetRect
SetFocus
SetCursor

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

ole32

CoCreateInstance
CoTaskMemFree
ReleaseStgMedium

msvcrt

malloc
_initterm
wcschr
_ftol
rand
memmove
floor
free
__CxxFrameHandler
_except_handler3
memset
memcpy
_adjust_fdiv

Sections

.text
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

10aca761f92181952653511fd51c4f9d

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

msvcrt

Sections

.text Size: 75KB - Virtual size: 75KB

.rdata Size: 35KB - Virtual size: 35KB

.data Size: 16KB - Virtual size: 57KB

.rsrc Size: 33KB - Virtual size: 33KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 75KB - Virtual size: 75KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 16KB - Virtual size: 57KB

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 3KB - Virtual size: 2KB