077a95a32349da2afa9524da4327ef15_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

077a95a32349da2afa9524da4327ef15_JaffaCakes118
Size

100KB
MD5

077a95a32349da2afa9524da4327ef15
SHA1

67c50478fa2f8ac8fa470f17524f11336690939d
SHA256

799ffa406732dc9789dc97bd15cde8252f7dc8f35bb4b1cff2d8a078b9373b5a
SHA512

e29be2ece60f46aa99cfa0bde7b406335359ab3a80d2dc91c257d636a76a6b76a88fde6f8f28d8329455c77fe6cddcdc0e42240e093813fa3bbdea87ce36aff6
SSDEEP

1536:DZtCJGO58iBPcsqqkYw/JLNqGdfdktm1jkPlGvcAH4L:bCJLBksq/rdfXjkPZX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
077a95a32349da2afa9524da4327ef15_JaffaCakes118

Files

077a95a32349da2afa9524da4327ef15_JaffaCakes118
.dll windows:4 windows x86 arch:x86

00742d938a9643380fc61e962c2f5946

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LocalAlloc
LocalFree
GetModuleFileNameW
lstrcmpiW
LoadLibraryExW
MultiByteToWideChar
lstrlenW
GetPrivateProfileStringA
lstrlenA
CloseHandle
WritePrivateProfileStringA
GetProcessHeap
WriteFile
SetFilePointer
FormatMessageW
SetEndOfFile
GetCurrentProcess
TlsFree
DisableThreadLibraryCalls
TlsAlloc
GetVersionExA
lstrcpyA
lstrcatA
GetStringTypeExA
IsDBCSLeadByte
TlsSetValue
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FreeLibrary
SizeofResource
LoadResource
FindResourceW
GetModuleHandleW
InterlockedExchange
Sleep
InterlockedCompareExchange
OutputDebugStringA
GetCommandLineA
FlushFileBuffers
VirtualProtect

user32

wsprintfA
CharPrevA
CharUpperA
LoadStringW
CharNextW
CharNextA
EnumChildWindows
GetSystemMetrics

advapi32

RegQueryInfoKeyW
RegSetValueExW
RegDeleteKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
FreeSid
RegDeleteValueW

ole32

CLSIDFromString
CoCreateInstance

msvcrt

_except_handler3
_initterm
malloc
free
memcpy
memset
_errno
_lock
_adjust_fdiv
_unlock
__dllonexit

Sections

.text
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

00742d938a9643380fc61e962c2f5946

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

msvcrt

Sections

.text Size: 36KB - Virtual size: 34KB

.rdata Size: 4KB - Virtual size: 1KB

.data Size: 36KB - Virtual size: 68KB

.rsrc Size: 16KB - Virtual size: 12KB

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 36KB - Virtual size: 34KB

.rdata
Size: 4KB - Virtual size: 1KB

.data
Size: 36KB - Virtual size: 68KB

.rsrc
Size: 16KB - Virtual size: 12KB

.reloc
Size: 4KB - Virtual size: 1KB