0a11cb87e011b00c5b8c41c3948aecea_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0a11cb87e011b00c5b8c41c3948aecea_JaffaCakes118
Size

49KB
MD5

0a11cb87e011b00c5b8c41c3948aecea
SHA1

501f172190d986e5b3e30584d2878040b5563136
SHA256

f6e5cd14916f2ae3c5a70d6a7a747c0fa1b6331427106e4a1041d34f49ffd0da
SHA512

7202c0d3a254b46ce4af3da5f713a09c731947bcee5e42d4c81ab6b1bd0974a61f033768af106dc7b33208c86406506dc5d2b06ba8b1eb303e0b18360f072cf4
SSDEEP

1536:aLCqnjj8RHRa2bEO/oWbgURKrAD6orq936hH:aLvnjjAa2bEO/nUrAD6ora36hH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a11cb87e011b00c5b8c41c3948aecea_JaffaCakes118

Files

0a11cb87e011b00c5b8c41c3948aecea_JaffaCakes118
.dll windows:4 windows x86 arch:x86

9a3891f0017b1b8f91f9f0d2137547c4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualProtect
GetCurrentProcessId
CreateToolhelp32Snapshot
GetProcessHeap
HeapAlloc
GetModuleFileNameA
Process32Next
lstrcmpiA
Process32First
WriteFile
WideCharToMultiByte
MultiByteToWideChar
GetTickCount
FindClose
FindFirstFileA
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
lstrlenA
OpenProcess
GetTempPathA
GetWindowsDirectoryA
ReleaseMutex
GetLastError
CreateMutexA
FreeLibrary
GetSystemDirectoryA
GetFileAttributesA
MoveFileExA
DeleteFileA
lstrcpynA
ReadProcessMemory
SetThreadPriority
DeviceIoControl
TerminateThread
CopyFileA
GlobalAlloc
GlobalFree
SetEndOfFile
VirtualAlloc
VirtualFree
GetModuleHandleA
CreateFileA
ReadFile
SetFilePointer
CloseHandle
GetFileSize
WritePrivateProfileStringA
IsBadReadPtr
GetCurrentProcess
TerminateProcess
ExitProcess
CreateThread
LoadLibraryA
GetProcAddress
GetPrivateProfileIntA
GetPrivateProfileStringA
Sleep
VirtualFreeEx
lstrcatA

user32

GetClassNameW
PostMessageA
wsprintfA
FindWindowA
GetForegroundWindow
GetWindow

gdi32

DeleteObject
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetDeviceCaps
CreateDCA
DeleteDC

advapi32

SetSecurityDescriptorDacl
RegEnumValueA
RegEnumKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
LookupPrivilegeValueA
AdjustTokenPrivileges
InitializeSecurityDescriptor

msvcrt

_strupr
_onexit
__dllonexit
_itoa
_strcmpi
srand
memset
strlen
free
strstr
_strlwr
_strdup
??2@YAPAXI@Z
_stricmp
strcpy
memcpy
strncpy
strcat
sprintf
strrchr
malloc
??3@YAXPAX@Z
_except_handler3
wcscat
wcscpy
wcslen
isspace
strchr
_vsnprintf
realloc
isdigit
isalpha
atoi
wcscmp
mbstowcs
wcsncat
wcsstr
exit
rand

msvcp60

??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ

wsock32

socket
WSAStartup
htons
connect
recv
closesocket
gethostbyname
shutdown
send

psapi

GetModuleFileNameExA
EnumProcessModules

gdiplus

GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdipDisposeImage
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToFile

Exports

Exports

pfjaoidjglkajd

Sections

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9a3891f0017b1b8f91f9f0d2137547c4

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

msvcrt

msvcp60

wsock32

psapi

gdiplus

Exports

Exports

Sections

.bss Size: - Virtual size: 3KB

.data Size: 44KB - Virtual size: 43KB

.CRT Size: 512B - Virtual size: 8B

.reloc Size: 3KB - Virtual size: 2KB

.bss
Size: - Virtual size: 3KB

.data
Size: 44KB - Virtual size: 43KB

.CRT
Size: 512B - Virtual size: 8B

.reloc
Size: 3KB - Virtual size: 2KB