064d7895d560eb339c425b150f41b6f7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

064d7895d560eb339c425b150f41b6f7_JaffaCakes118
Size

64KB
MD5

064d7895d560eb339c425b150f41b6f7
SHA1

01d20ef152ebc0d14f54c559274288ebc234f9ee
SHA256

21658ea5ef78914e3b53a68b1d6c11ff69afffe68555281154aceecc2ca3ea77
SHA512

15bd23e6d892e8655d833233ebe02521293ccaa9dfd451b63d35843868166f94cdbef74a59b5d9e819dda60a5c183b061312e72dab61587fccfbfc0e3623c91f
SSDEEP

1536:hz5drNQOQYeI/vzswiA0ZTEGZbUinl1Adr63UW3zc6R/oZ:zTViI/7swiA0ZhZ4ibAsEW3zcqoZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
064d7895d560eb339c425b150f41b6f7_JaffaCakes118

Files

064d7895d560eb339c425b150f41b6f7_JaffaCakes118
.dll windows:4 windows x86 arch:x86

0421c3cc0ea7fcac44d86265fcbac170

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
AddVectoredExceptionHandler
InitializeCriticalSection
IsBadReadPtr
LeaveCriticalSection
EnterCriticalSection
VirtualProtect
FlushInstructionCache
GetCurrentProcess
Thread32Next
SetThreadContext
GetThreadContext
OpenThread
Thread32First
CreateToolhelp32Snapshot
GetProcessHeap
HeapAlloc
OutputDebugStringA
Process32Next
lstrcmpiA
Process32First
OpenProcess
GetLastError
WriteFile
ReadFile
lstrcatA
GetTickCount
GetSystemDirectoryA
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
lstrlenA
GetTempPathA
lstrcpynA
ReadProcessMemory
SetThreadPriority
DeviceIoControl
GetFileAttributesA
MoveFileExA
CopyFileA
ReleaseSemaphore
CreateSemaphoreA
GlobalAlloc
GlobalFree
SetEndOfFile
SetFilePointer
GetFileSize
GetProcAddress
GetCurrentProcessId
CreateMutexA
ReleaseMutex
CloseHandle
GetCurrentThreadId
lstrcpyA
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetModuleFileNameA
CreateThread
Sleep
GetCommandLineA
MultiByteToWideChar
WideCharToMultiByte

user32

GetClassNameW
GetWindow
EnumWindows
wvsprintfA
GetForegroundWindow
SetWindowsHookExA
wsprintfW
CallNextHookEx
PostThreadMessageA
PostMessageA
wsprintfA
UnhookWindowsHookEx
GetWindowThreadProcessId
GetMessageA
FindWindowA

gdi32

CreateDCA
GetDeviceCaps
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteDC
DeleteObject

advapi32

RegEnumKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumValueA

msvcrt

_strnicmp
__dllonexit
exit
_initterm
_adjust_fdiv
wcsstr
_onexit
_strcmpi
_strupr
_strdup
wcsncat
memset
strcpy
fclose
fgets
fopen
strncpy
strchr
strstr
wcsncpy
??2@YAPAXI@Z
strcat
strrchr
_except_handler3
free
_stricmp
strlen
malloc
memcpy
??3@YAXPAX@Z
wcscat
wcscpy
wcslen
rand
srand
sprintf
isspace
isalnum
_vsnprintf
realloc
isdigit
isalpha
atoi
wcscmp
mbstowcs
_strlwr

gdiplus

GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipDisposeImage
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusStartup

msvcp60

??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ

wsock32

gethostbyname
send
closesocket
recv
connect
htons
socket
WSAStartup
shutdown

psapi

GetModuleFileNameExA
EnumProcessModules

Exports

Exports

asdfghjkl
qwertyui

Sections

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0421c3cc0ea7fcac44d86265fcbac170

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

msvcrt

gdiplus

msvcp60

wsock32

psapi

Exports

Exports

Sections

.bss Size: - Virtual size: 3KB

.data Size: 47KB - Virtual size: 47KB

.reloc Size: 3KB - Virtual size: 2KB

.bss
Size: - Virtual size: 3KB

.data
Size: 47KB - Virtual size: 47KB

.reloc
Size: 3KB - Virtual size: 2KB