06ce671b3a7742954f2840d24bc23f26_JaffaCakes118

General

Target

06ce671b3a7742954f2840d24bc23f26_JaffaCakes118
Size

22KB
MD5

06ce671b3a7742954f2840d24bc23f26
SHA1

1da9cc2d381391cff53771fa9ba258069262ad16
SHA256

02e4fc0f6559fb4784109e1ffb41e593e31f891d6a4b9030365550abc8e9c2f1
SHA512

8d69e8992d4c69df71b0704ede291bdc629b60ec7a0180c860263d9e20c6709939f3a5995e9bead08db3982894de3b7be7239489676e99f827f96a5af4cb4193
SSDEEP

384:xDxLXHWyiO5SgqaV4cMyg/DJdEEu0Ati4Wn0GdqTp/Sl5m:x9XREaVj+XtVAtiSG2Sl5m

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06ce671b3a7742954f2840d24bc23f26_JaffaCakes118

Files

06ce671b3a7742954f2840d24bc23f26_JaffaCakes118
.dll windows:4 windows x86 arch:x86

fc19976535ea9a6acb5757f05c888309

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReadProcessMemory
VirtualQueryEx
OpenProcess
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
SetFilePointer
OutputDebugStringA
HeapAlloc
GetProcessHeap
GetFileAttributesW
GetModuleHandleA
GetTempPathA
DeleteFileA
GetProcAddress
GetPrivateProfileStringA
CreateFileA
GetFileSize
ReadFile
CloseHandle
Sleep
WideCharToMultiByte
GetModuleFileNameA
LoadLibraryA

user32

GetDC
GetWindowRect
wsprintfA
GetWindow
GetClassNameW

wininet

InternetCloseHandle

msvcrt

_strupr
_strcmpi
free
strcpy
memset
malloc
strcat
sprintf
strlen
??3@YAXPAX@Z
wcscmp
??2@YAPAXI@Z
ftell
fseek
fopen
mbstowcs
strstr
strrchr
_except_handler3
strncpy
rand
srand
time
wcslen
wcsncat
wcscpy
wcsstr
exit
printf
_stricmp
memcpy
_local_unwind2
strcmp
_vsnprintf

gdiplus

GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipDisposeImage
GdipGetImageEncodersSize
GdipGetImageEncoders

gdi32

SelectObject
DeleteObject
CreateCompatibleDC
GetDeviceCaps
CreateDCA
CreateCompatibleBitmap
BitBlt
DeleteDC

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fc19976535ea9a6acb5757f05c888309

Headers

File Characteristics

Imports

kernel32

user32

wininet

msvcrt

gdiplus

gdi32

Sections

.text Size: 16KB - Virtual size: 16KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 1024B - Virtual size: 3KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 16KB - Virtual size: 16KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1024B - Virtual size: 3KB

.reloc
Size: 1KB - Virtual size: 1KB