ffd5d97ee6efd39bfeea56ac328dfb99_JaffaCakes118

General

Target

ffd5d97ee6efd39bfeea56ac328dfb99_JaffaCakes118
Size

44KB
MD5

ffd5d97ee6efd39bfeea56ac328dfb99
SHA1

b30594f83bbd0df4913222f1240117be951a2880
SHA256

14721ac2a02a76502ab83447b509270989207f2c835e798220664407c3cce72b
SHA512

3f7ab3013fd712ad4acfd78e72c840cf36e1f60ee12de9d2e5ad97c8e914d8371653933e36ba3e5166f4f1f2d4c363be4f18a4383254e5ebff274db56292fcd9
SSDEEP

768:EM/62DePvlPVqJ7Wmw+S47EwI2HBfnhJuVMy9HZbpkavs5+skgLa1I4O:56rj95e9cELaS4O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffd5d97ee6efd39bfeea56ac328dfb99_JaffaCakes118

Files

ffd5d97ee6efd39bfeea56ac328dfb99_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

4df02192c0f15e606cf9a33e0c1988c4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateThread
VirtualAlloc
GetLastError
GetLocalTime
CreateProcessA
GetSystemDirectoryA
WinExec
GetWindowsDirectoryA
InterlockedIncrement
GetModuleFileNameA
LoadLibraryA
GetProcAddress
CloseHandle
CreateMutexA

user32

GetMessageA
CallNextHookEx
PostMessageA
FindWindowExA
TranslateMessage
SetWindowsHookExA
UnhookWindowsHookEx
KillTimer
SetTimer
DefWindowProcA
CreateWindowExA
RegisterClassExA
DispatchMessageA
ShowWindow

advapi32

RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey

msvcrt

atoi
_adjust_fdiv
malloc
_initterm
free
strchr
fopen
fwrite
fclose
_stricmp
_except_handler3
__CxxFrameHandler
??2@YAPAXI@Z
??3@YAXPAX@Z
sprintf
strrchr

shlwapi

SHGetValueA

wininet

HttpQueryInfoA
InternetOpenUrlA
InternetSetOptionA
InternetOpenA
InternetReadFile
InternetCloseHandle

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 884B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4df02192c0f15e606cf9a33e0c1988c4

Headers

File Characteristics

Imports

kernel32

user32

advapi32

msvcrt

shlwapi

wininet

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 20KB

.rdata Size: 4KB - Virtual size: 1KB

.data Size: 8KB - Virtual size: 5KB

.reloc Size: 4KB - Virtual size: 884B

.text
Size: 24KB - Virtual size: 20KB

.rdata
Size: 4KB - Virtual size: 1KB

.data
Size: 8KB - Virtual size: 5KB

.reloc
Size: 4KB - Virtual size: 884B