f063f1cb84137bfe74b2810a7e9db12e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f063f1cb84137bfe74b2810a7e9db12e_JaffaCakes118
Size

140KB
MD5

f063f1cb84137bfe74b2810a7e9db12e
SHA1

3db5e89871a460482f56e76ecee70d4357e8d57b
SHA256

7a61c997a146bf5d46f700b9b243859327a3847ba2eb85f8b013fe842b520dcd
SHA512

fd26a5d7c2803649b5bae4893dc81b8d0a2f031953756ec7c6cc3ec2a0c1eeed11ddf8ae53bcb6ef5324f56492f48e46910a60856723afb103a08c70aaa8fd05
SSDEEP

3072:OLl9L9ZWN9bvsHTtfGUMQUanJNxdbY6MBOCGu0+zfxXmUo70+TK:CIDzsz8yUglm6aGFxK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f063f1cb84137bfe74b2810a7e9db12e_JaffaCakes118

Files

f063f1cb84137bfe74b2810a7e9db12e_JaffaCakes118
.dll windows:6 windows x86 arch:x86

3e1177f112ef707ede53bd41f788cd94

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualProtect
GetCurrentProcess
GetModuleHandleA
OpenProcess
Sleep
GetCurrentThread
CloseHandle
K32GetModuleInformation
GetProcAddress
WideCharToMultiByte
DisableThreadLibraryCalls
CreateThread
ExitProcess
HeapFree
MultiByteToWideChar
HeapAlloc
GetProcessHeap
LoadLibraryA
TerminateProcess
GetCurrentProcessId
IsDebuggerPresent
CreateMutexA
InitializeCriticalSectionEx
HeapSize
GetLastError
HeapReAlloc
RaiseException
DecodePointer
DeleteCriticalSection
GetCurrentThreadId
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualFree
VirtualQuery
SetLastError
FreeLibrary
GetModuleHandleW
LoadLibraryExW
CreateFileW
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
SetStdHandle
SetFilePointerEx
WriteConsoleW
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventW
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
RtlUnwind
InterlockedFlushSList
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW

user32

MessageBoxA
CreateWindowExA
GetWindowThreadProcessId
GetWindow
GetTopWindow
GetClassNameA

ws2_32

WSAAddressToStringA
gethostbyname

Exports

Exports

_DllMain@12

Sections

.text
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3e1177f112ef707ede53bd41f788cd94

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ws2_32

Exports

Exports

Sections

.text Size: 95KB - Virtual size: 94KB

.rdata Size: 30KB - Virtual size: 29KB

.data Size: 2KB - Virtual size: 5KB

.detourc Size: 4KB - Virtual size: 4KB

.detourd Size: 512B - Virtual size: 12B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 95KB - Virtual size: 94KB

.rdata
Size: 30KB - Virtual size: 29KB

.data
Size: 2KB - Virtual size: 5KB

.detourc
Size: 4KB - Virtual size: 4KB

.detourd
Size: 512B - Virtual size: 12B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 6KB - Virtual size: 6KB