03e8b9d462666ba1e761eeec4e141cb7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

03e8b9d462666ba1e761eeec4e141cb7_JaffaCakes118
Size

152KB
MD5

03e8b9d462666ba1e761eeec4e141cb7
SHA1

28b58143f124fa35444608f3ae152cc19ededdb6
SHA256

ea4c84bf3fdd6a5f10cb4d1791a4a422ed8bcbe10dab24138779553eab57d729
SHA512

c20677a04d3d4b59855ee5e8ad91e47780afc9931e8a7c7314aed15a329a107845c3810658b0b697b4c2224f4470866a357ade3cd1b8f02bd2a74e27a158fea6
SSDEEP

3072:/uk3xTR/IJhcG0/bO4XiooDutod7Svj/uzEg2CZlaf/lXWGW/17PtO4bd:/P3xd/IgG+yo0uMOrNCZk1GF17lOK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
03e8b9d462666ba1e761eeec4e141cb7_JaffaCakes118

Files

03e8b9d462666ba1e761eeec4e141cb7_JaffaCakes118
.dll windows:4 windows x86 arch:x86

ac6b44bed0f2c17bdfcf32b55e037767

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

InterlockedCompareExchange
CloseHandle
GlobalAlloc
GetCurrentProcess
WriteProcessMemory
GlobalFree
GetTickCount
WriteFile
EnterCriticalSection
SetLastError
CreateFileMappingA
OpenFileMappingA
GetCommandLineA
WaitForSingleObject
GetLastError
OpenEventA
MapViewOfFile
InterlockedDecrement
UnmapViewOfFile
GetProcessHeap
HeapAlloc
TerminateProcess
HeapFree
CreateEventA
CreateProcessA
CreateFileA
GetProcAddress
GetModuleFileNameA
LocalFree
LoadLibraryA
InterlockedIncrement
GetComputerNameA
ExitProcess
LeaveCriticalSection
CreateDirectoryA
Sleep
GetVolumeInformationA
CreateMutexW
CopyFileA
ReadProcessMemory
GetModuleHandleA

ole32

CoTaskMemAlloc
CoSetProxyBlanket
OleCreate
CoInitialize
CoUninitialize
OleSetContainedObject
CoCreateGuid
CoCreateInstance

user32

GetWindowLongA
SetWindowLongA
GetClassNameA
DispatchMessageA
ClientToScreen
GetMessageA
GetCursorPos
RegisterWindowMessageA
CreateWindowExA
KillTimer
SendMessageA
DestroyWindow
FindWindowA
GetSystemMetrics
DefWindowProcA
PostQuitMessage
GetWindowThreadProcessId
UnhookWindowsHookEx
PeekMessageA
ScreenToClient
GetWindow
TranslateMessage
SetWindowsHookExA
SetTimer
GetParent

oleaut32

SysAllocString
SysStringLen
SysFreeString
SysAllocStringLen

shlwapi

StrStrIW
UrlUnescapeW

advapi32

RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
SetTokenInformation
DuplicateTokenEx
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
GetUserNameA
OpenProcessToken
RegCloseKey

shell32

SHGetFolderPathA

Exports

Exports

SysPathhid

Sections

.text
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac6b44bed0f2c17bdfcf32b55e037767

Headers

File Characteristics

Imports

kernel32

ole32

user32

oleaut32

shlwapi

advapi32

shell32

Exports

Exports

Sections

.text Size: 124KB - Virtual size: 123KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 964B

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 124KB - Virtual size: 123KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 964B

.reloc
Size: 8KB - Virtual size: 6KB