f6c1ff7d90118e829305c72e67f824f2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f6c1ff7d90118e829305c72e67f824f2_JaffaCakes118
Size

632KB
MD5

f6c1ff7d90118e829305c72e67f824f2
SHA1

a10021ea04314fbce6ff3af5dccf9588162d22b4
SHA256

959a748145f0097f3f8e8275f0c53f89918e0f65930fb4688dacc22ef2845201
SHA512

f353d51ea54693e68c823f747022d59dccad1d3d3f8069dfd5bc82addbe501b43f99a41c9b4567227e0aaf669812b6466c2532dc33a1f60ae710b4f00a797459
SSDEEP

12288:tZf1GimD3vrDwusjySr4Nwu/PFVPoyNTb9KNfzkwT:T1GimDzsu8Rr4Nwu3F1rTqf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6c1ff7d90118e829305c72e67f824f2_JaffaCakes118

Files

f6c1ff7d90118e829305c72e67f824f2_JaffaCakes118
.dll windows:4 windows x86 arch:x86

0ca49cf656d445b544dedc4c6555562d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Projects\LoaderSourceCode\debug\msvcr80.pdb

Imports

urlmon

URLDownloadToFileA

user32

GetParent
ShowWindow
SetWindowsHookExW
SetWindowTextA
SetWindowTextW
PeekMessageA
PeekMessageW
GetMessageW
CreateWindowExW
PostMessageW
SendMessageW
LoadBitmapA
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
DestroyWindow
CreateWindowExA
PostMessageA
GetMessageA
SetWindowPos
InvalidateRect
EnumWindows
GetWindowThreadProcessId
FindWindowExA
SendMessageA
GetWindowLongA
SetPropA
SetWindowLongA
GetWindow
GetPropA
GetFocus
CallWindowProcA
IsWindowVisible
GetClassNameA
GetWindowTextA
GetWindowRect

gdi32

DeleteObject

comctl32

ImageList_Add
ImageList_Create

ws2_32

WSAStartup

advapi32

RegEnumValueA
RegOpenKeyExA
RegEnumKeyA
RegCloseKey
RegOpenKeyA
RegQueryValueA
RegQueryValueExA

shell32

ShellExecuteA

kernel32

IsValidLocale
GetLocaleInfoA
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetSystemTimeAsFileTime
IsValidCodePage
SetFilePointer
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
HeapReAlloc
LoadLibraryW
GetUserDefaultLCID
EnumSystemLocalesA
WriteConsoleA
GetTickCount
GetConsoleOutputCP
SetConsoleCtrlHandler
ExitProcess
SetStdHandle
GetTimeZoneInformation
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
QueryPerformanceCounter
GetCommandLineW
GetFileType
WriteConsoleW
AddVectoredExceptionHandler
IsBadReadPtr
VirtualProtect
GetModuleHandleExA
FlushInstructionCache
GetCurrentProcess
Thread32Next
CloseHandle
SetThreadContext
GetThreadContext
OpenThread
GetCurrentProcessId
Thread32First
CreateToolhelp32Snapshot
MultiByteToWideChar
InterlockedCompareExchange
LoadLibraryA
OutputDebugStringW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
CreateFileA
GetSystemDirectoryA
InterlockedExchange
SleepEx
CreateThread
GetModuleHandleA
WideCharToMultiByte
OpenProcess
GetModuleFileNameA
GetCommandLineA
LoadLibraryExW
GetPrivateProfileStringA
GetPrivateProfileIntA
GetModuleFileNameW
OutputDebugStringA
Sleep
Module32Next
Module32First
GetModuleHandleW
GetProcAddress
SetLastError
FreeLibrary
VirtualQuery
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RaiseException
DebugBreak
IsDebuggerPresent
lstrlenA
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapValidate
GetCurrentThreadId
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetLastError
GetCurrentThread
GetACP
GetOEMCP
GetCPInfo
FatalAppExitA
GetStdHandle
WriteFile

Exports

Exports

Test
UnTest
WhatIsThis

Sections

.textbss
Size: - Virtual size: 233KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 497KB - Virtual size: 496KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0ca49cf656d445b544dedc4c6555562d

Headers

File Characteristics

PDB Paths

Imports

urlmon

user32

gdi32

comctl32

ws2_32

advapi32

shell32

kernel32

Exports

Exports

Sections

.textbss Size: - Virtual size: 233KB

.text Size: 497KB - Virtual size: 496KB

.rdata Size: 84KB - Virtual size: 83KB

.data Size: 17KB - Virtual size: 126KB

.idata Size: 6KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 23KB - Virtual size: 22KB

.textbss
Size: - Virtual size: 233KB

.text
Size: 497KB - Virtual size: 496KB

.rdata
Size: 84KB - Virtual size: 83KB

.data
Size: 17KB - Virtual size: 126KB

.idata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 23KB - Virtual size: 22KB