fd633bfe9f4a97166239c61075043755_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

fd633bfe9f4a97166239c61075043755_JaffaCakes118
Size

148KB
MD5

fd633bfe9f4a97166239c61075043755
SHA1

c5a6614731ab0d8993518f078acddc9002fc3104
SHA256

ba81591be8a160904caa93d04ebf43e4cb78901a89a403cb253d31178a2c19a6
SHA512

0ec3e515af771fbfd9f85001dbeee2e5d61c47b7e21d055413e61a7ce28f6351b353aeede6c2ff995bd5ed380086d107811cf3e114a41536f4b24601947cbc51
SSDEEP

3072:xfDwulE+tmhCZd+ZmXWbSq6yeGVW4BAIbRr8/GmIDlSI70TZrodoXUD:xHE+A4+Z8mj6cVW4Bdb+6DlpiNod0I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fd633bfe9f4a97166239c61075043755_JaffaCakes118

Files

fd633bfe9f4a97166239c61075043755_JaffaCakes118
.dll windows:4 windows x86 arch:x86

31b6a4ba7361d15a26769637e80eb320

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

InterlockedCompareExchange
GetProcessHeap
Sleep
WriteProcessMemory
CreateMutexW
MapViewOfFile
HeapFree
CreateFileMappingA
GetTickCount
InterlockedDecrement
GetVolumeInformationA
GetModuleFileNameA
LoadLibraryA
UnmapViewOfFile
OpenEventA
CreateEventA
HeapAlloc
InterlockedIncrement
GetCurrentProcess
WriteFile
CreateDirectoryA
GlobalFree
OpenFileMappingA
ExitProcess
CopyFileA
GetProcAddress
CloseHandle
CreateFileA
ReadProcessMemory
GetComputerNameA
GetLastError
TerminateProcess
CreateProcessA
GetCommandLineA
GetModuleHandleA
EnterCriticalSection
WaitForSingleObject
LeaveCriticalSection
GlobalAlloc
SetLastError
LocalFree

ole32

OleSetContainedObject
CoCreateInstance
CoInitialize
CoCreateGuid
CoUninitialize
CoSetProxyBlanket
CoTaskMemAlloc
OleCreate

user32

DefWindowProcA
GetParent
DispatchMessageA
GetSystemMetrics
SetTimer
PostQuitMessage
SendMessageA
ScreenToClient
SetWindowsHookExA
GetWindowThreadProcessId
GetWindowLongA
GetCursorPos
TranslateMessage
FindWindowA
PeekMessageA
GetMessageA
RegisterWindowMessageA
GetClassNameA
KillTimer
DestroyWindow
CreateWindowExA
GetWindow
SetWindowLongA
ClientToScreen
UnhookWindowsHookEx

oleaut32

SysStringLen
SysAllocString
SysAllocStringLen
SysFreeString

shlwapi

UrlUnescapeW
StrStrIW

advapi32

OpenProcessToken
RegDeleteKeyA
RegCloseKey
RegQueryValueExA
SetTokenInformation
GetUserNameA
DuplicateTokenEx
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteValueA

shell32

SHGetFolderPathA

Exports

Exports

WdPadsvc

Sections

.text
Size: 116KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

nez
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

31b6a4ba7361d15a26769637e80eb320

Headers

File Characteristics

Imports

kernel32

ole32

user32

oleaut32

shlwapi

advapi32

shell32

Exports

Exports

Sections

.text Size: 116KB - Virtual size: 113KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 992B

nez Size: 4KB - Virtual size: 16B

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 116KB - Virtual size: 113KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 992B

nez
Size: 4KB - Virtual size: 16B

.reloc
Size: 8KB - Virtual size: 6KB