f70598691700ef6ea885beece2052422_JaffaCakes118

General

Target

f70598691700ef6ea885beece2052422_JaffaCakes118
Size

84KB
MD5

f70598691700ef6ea885beece2052422
SHA1

ec695bcf5da9b25a21b89393db3ba5bdccd37f4c
SHA256

a34deea7d30df410b342134b36f602ef82ed5bb49ee182c0702a9437a3306a1d
SHA512

4c93c7303d4df6ad0c74b0f50afaf6d2313cb19e76cca6b885be76e614a9855310cef215d4b492768f5806c0ebc05ca0a621b791a28e380641f8228a3aaabbf8
SSDEEP

1536:0LssI6lIZKovOOtQ4YO7vUsqmd/v24i3E0dsIa+y0ryZfp:pH6lIZS74YOpd/e4J+yZfp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f70598691700ef6ea885beece2052422_JaffaCakes118

Files

f70598691700ef6ea885beece2052422_JaffaCakes118
.dll windows:4 windows x86 arch:x86

7d8a67f60ba649a63f31d5a7ffb0d0ed

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

time
srand
rand
_vsnprintf
tolower
strrchr
_except_handler3
malloc
strncpy
free
atoi
__CxxFrameHandler
??2@YAPAXI@Z
??3@YAXPAX@Z
memcpy
strlen
sprintf
memset
_strcmpi

kernel32

lstrlenA
MultiByteToWideChar
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
OpenThread
GetThreadContext
SetThreadContext
Thread32Next
EnterCriticalSection
LeaveCriticalSection
IsBadReadPtr
HeapAlloc
GetProcessHeap
Sleep
LoadLibraryA
GetComputerNameA
CloseHandle
GetFileSize
ReadFile
SetFilePointer
GetProcAddress
GetModuleHandleA
AddVectoredExceptionHandler
VirtualProtect
FlushInstructionCache
GetCurrentProcess
InitializeCriticalSection

user32

UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
wsprintfA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

Exports

Exports

CancelDll
LoadDll

Sections

.text
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7d8a67f60ba649a63f31d5a7ffb0d0ed

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 28KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 28KB - Virtual size: 28KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 8KB - Virtual size: 8KB