fa2ef8f2a725e6bb049c59e37c636a2e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fa2ef8f2a725e6bb049c59e37c636a2e_JaffaCakes118
Size

26KB
MD5

fa2ef8f2a725e6bb049c59e37c636a2e
SHA1

e996f623e3b65f8170923b2356230581aac11f7f
SHA256

cc719ad7cbab759ecf9b4638d45b439a1e20cb37cf2e79ac3be2ef8a3358dc63
SHA512

30e7aea483a42ab52fbd8ce64a8a650eb468923c206d36373d79f69c48838528b03dd9260d260730a848d9b6e2addac786dfa5db20019e70803470e6ffb92f9e
SSDEEP

768:2qCHVTGP/gSNDXvh6I/U14zIQpR20Qsv6:2quaP/gEX5/U1WdZ6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa2ef8f2a725e6bb049c59e37c636a2e_JaffaCakes118

Files

fa2ef8f2a725e6bb049c59e37c636a2e_JaffaCakes118
.dll windows:4 windows x86 arch:x86

85e2133ce93a2818d6bccb798526af56

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OpenEventA
GetModuleHandleA
ResetEvent
WaitForSingleObject
CreateEventA
FreeLibraryAndExitThread
SetThreadPriority
GetCurrentThread
ReleaseMutex
FreeLibrary
Sleep
SetEvent
CreateMutexA
CreateThread
DisableThreadLibraryCalls
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
MapViewOfFile
VirtualFree
VirtualProtect
VirtualAlloc
Process32Next
Process32First
CreateToolhelp32Snapshot
Module32Next
Module32First
VirtualQuery
GetSystemInfo
GetCurrentProcess
WinExec
WriteFile
CreateFileA
GetTempFileNameA
GetShortPathNameA
GetTempPathA
UnmapViewOfFile
CloseHandle
CreateFileMappingA
LoadLibraryA
GetPrivateProfileStringA
GetProcAddress
GetModuleFileNameA
GetCurrentProcessId
WideCharToMultiByte
InterlockedCompareExchange

user32

CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
ShowWindow
UpdateWindow
CreateWindowExA
RegisterClassA
EnumDesktopWindows
GetWindowTextA
GetClassNameA
GetWindowThreadProcessId

advapi32

OpenProcessToken
RegEnumValueA
RegOpenKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegCloseKey

msvcp60

?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

wininet

InternetConnectA
HttpSendRequestA
HttpAddRequestHeadersA
DeleteUrlCacheEntry
InternetCloseHandle
InternetCrackUrlA
InternetOpenA
HttpOpenRequestA
InternetReadFile

urlmon

URLDownloadToFileA

ws2_32

closesocket
WSACleanup
setsockopt

msvcrt

strcpy
difftime
strcat
memset
time
_mbsicmp
_except_handler3
_local_unwind2
_ismbcprint
_mbsupr
_mbsrchr
_memicmp
_adjust_fdiv
malloc
_initterm
_onexit
__dllonexit
free
_ismbcspace
_mbsinc
memmove
sprintf
_mbsnbicmp
abs
memcmp
_mbsstr
_mbscmp
memcpy
??2@YAPAXI@Z
__CxxFrameHandler
_EH_prolog
strlen
_snprintf
_mbsnbcpy

Exports

Exports

_DllMain@12

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

85e2133ce93a2818d6bccb798526af56

Headers

File Characteristics

Imports

kernel32

user32

advapi32

msvcp60

wininet

urlmon

ws2_32

msvcrt

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 23KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 24KB - Virtual size: 23KB

.reloc
Size: 1KB - Virtual size: 1KB