fde4afc876cfaa6186c80ccf479aaffd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fde4afc876cfaa6186c80ccf479aaffd_JaffaCakes118
Size

152KB
MD5

fde4afc876cfaa6186c80ccf479aaffd
SHA1

47db7c82005336e5baf3cf8b8e15ec5b428ed1a0
SHA256

ca231463b598fc691c6c861dbd3cc2664b995aac273cbc8d9c74d0f58908214f
SHA512

eeca8230cb095b766d3c5b7095806583dc69d95b748ef42f02e661c680b034bc1da28110874b9cf61162b7869609f378aae62e12b5a950f7497b7e5d7a03279d
SSDEEP

3072:67P1dA6TqH0f5K+B5/Cbb8Lp7RCauLVoPnN42:en+0f5//142

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fde4afc876cfaa6186c80ccf479aaffd_JaffaCakes118

Files

fde4afc876cfaa6186c80ccf479aaffd_JaffaCakes118
.dll windows:4 windows x86 arch:x86

25d835d4986194cecaef263d45b5dd91

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

EnterCriticalSection
ReadProcessMemory
MapViewOfFile
CloseHandle
GetComputerNameA
GetCurrentProcess
CreateProcessA
GetCommandLineA
WriteFile
InterlockedDecrement
HeapAlloc
GetModuleFileNameA
CreateMutexW
GetProcAddress
SetLastError
InterlockedIncrement
GetLastError
CreateFileMappingA
InterlockedCompareExchange
CreateDirectoryA
UnmapViewOfFile
ExitProcess
GlobalAlloc
GlobalFree
GetTickCount
GetVolumeInformationA
CopyFileA
Sleep
LoadLibraryA
OpenFileMappingA
GetProcessHeap
LocalFree
CreateEventA
CreateFileA
TerminateProcess
OpenEventA
LeaveCriticalSection
GetModuleHandleA
WaitForSingleObject
WriteProcessMemory
HeapFree

ole32

CoTaskMemAlloc
CoSetProxyBlanket
CoCreateGuid
CoInitialize
OleSetContainedObject
OleCreate
CoCreateInstance
CoUninitialize

user32

TranslateMessage
GetParent
GetWindowThreadProcessId
GetWindowLongA
SetWindowsHookExA
UnhookWindowsHookEx
ScreenToClient
GetWindow
GetSystemMetrics
SetWindowLongA
ClientToScreen
KillTimer
CreateWindowExA
PostQuitMessage
GetMessageA
DestroyWindow
DefWindowProcA
RegisterWindowMessageA
GetClassNameA
SendMessageA
DispatchMessageA
FindWindowA
SetTimer
PeekMessageA
GetCursorPos

oleaut32

SysAllocString
SysFreeString
SysAllocStringLen
SysStringLen

shlwapi

StrStrIW
UrlUnescapeW

advapi32

RegOpenKeyExA
RegCreateKeyExA
DuplicateTokenEx
OpenProcessToken
GetUserNameA
RegQueryValueExA
SetTokenInformation
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegSetValueExA

shell32

SHGetFolderPathA

Exports

Exports

eventnetSnap

Sections

.text
Size: 120KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

vcrrg
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

25d835d4986194cecaef263d45b5dd91

Headers

File Characteristics

Imports

kernel32

ole32

user32

oleaut32

shlwapi

advapi32

shell32

Exports

Exports

Sections

.text Size: 120KB - Virtual size: 117KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 948B

vcrrg Size: 4KB - Virtual size: 12B

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 120KB - Virtual size: 117KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 948B

vcrrg
Size: 4KB - Virtual size: 12B

.reloc
Size: 8KB - Virtual size: 6KB