16f85e17ede9cf35df627a04e1ba17e8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

16f85e17ede9cf35df627a04e1ba17e8_JaffaCakes118
Size

88KB
MD5

16f85e17ede9cf35df627a04e1ba17e8
SHA1

be309a199be66eb15d94a1ae3f4f4c7eb5eb193e
SHA256

a561c452685b9e1fd03ee2e34f2b060aa5b9791d9cceac1341380565c7f2c386
SHA512

8a288f32760a6489329c1e6488de5ad11047dd026936f58cce273732d304041f3640fe589c0f4b571e6a09201c097cd6cfbe1ee9ea714d652469ddee50216562
SSDEEP

768:MqH1zphn8vX/rTsruhjV6U6haTPLOBLRnGEzs9kNSbc03umQJi:2r4ruh56UbPMHz1NSbc03umOi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16f85e17ede9cf35df627a04e1ba17e8_JaffaCakes118

Files

16f85e17ede9cf35df627a04e1ba17e8_JaffaCakes118
.dll windows:4 windows x86 arch:x86

726407322d2ce2ba8fc91b79b1567ebd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
OpenFileMappingA
WideCharToMultiByte
lstrlenW
IsBadReadPtr
LoadLibraryA
GetProcAddress
FreeLibrary
VirtualProtect
CreateThread
GetTickCount
VirtualAlloc
VirtualFree
VirtualQuery
HeapCreate
GetSystemInfo
lstrcpyA
InterlockedIncrement
ExitProcess
GetModuleFileNameA
DisableThreadLibraryCalls
GetCurrentThreadId
CreateFileMappingA
GetLastError
GetCommandLineA
GetCurrentDirectoryA
OpenProcess
ReleaseMutex
CreateMutexA
Process32Next
TerminateProcess
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
ReadProcessMemory
VirtualProtectEx
WriteProcessMemory
GetCurrentProcess
Module32Next
Module32First
MapViewOfFile
lstrlenA
UnmapViewOfFile
IsBadStringPtrA
GetWindowsDirectoryA
WritePrivateProfileStringA
GetSystemDirectoryA
lstrcatA
GetPrivateProfileStringA
GetModuleHandleA
Sleep
GetCurrentProcessId

user32

wsprintfA
CallNextHookEx
PostThreadMessageA
UnhookWindowsHookEx
GetMessageA
SetWindowsHookExA
GetWindowThreadProcessId
EnumWindows

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA

shlwapi

PathFileExistsA
StrStrIA
StrStrW
StrStrA

msvcrt

_stricmp
_memicmp
_adjust_fdiv
_initterm
isprint
strrchr
atol
fopen
fseek
ftell
rewind
strstr
__CxxFrameHandler
isdigit
sscanf
sprintf
atoi
_itoa
isspace
isalnum
free
malloc
fgetc

Exports

Exports

CtfAImmActivate
CtfAImmDeactivate
CtfAImmIsIME
CtfImmCoUninitialize
CtfImmDispatchDefImeMessage
CtfImmEnterCoInitCountSkipMode
CtfImmGenerateMessage
CtfImmGetGuidAtom
CtfImmHideToolbarWnd
CtfImmIsCiceroEnabled
CtfImmIsCiceroStartedInThread
CtfImmIsGuidMapEnable
CtfImmIsTextFrameServiceDisabled
CtfImmLastEnabledWndDestroy
CtfImmLeaveCoInitCountSkipMode
CtfImmRestoreToolbarWnd
CtfImmSetAppCompatFlags
CtfImmSetCiceroStartInThread
CtfImmTIMActivate
GetKeyboardLayoutCP
ImmActivateLayout
ImmAssociateContext
ImmAssociateContextEx
ImmCallImeConsoleIME
ImmConfigureIMEA
ImmConfigureIMEW
ImmCreateContext
ImmCreateIMCC
ImmCreateSoftKeyboard
ImmDestroyContext
ImmDestroyIMCC
ImmDestroySoftKeyboard
ImmDisableIME
ImmDisableIme
ImmDisableTextFrameService
ImmEnumInputContext
ImmEnumRegisterWordA
ImmEnumRegisterWordW
ImmEscapeA
ImmEscapeW
ImmFreeLayout
ImmGenerateMessage
ImmGetAppCompatFlags
ImmGetCandidateListA
ImmGetCandidateListCountA
ImmGetCandidateListCountW
ImmGetCandidateListW
ImmGetCandidateWindow
ImmGetCompositionFontA
ImmGetCompositionFontW
ImmGetCompositionStringA
ImmGetCompositionStringW
ImmGetCompositionWindow
ImmGetContext
ImmGetConversionListA
ImmGetConversionListW
ImmGetConversionStatus
ImmGetDefaultIMEWnd
ImmGetDescriptionA
ImmGetDescriptionW
ImmGetGuideLineA
ImmGetGuideLineW
ImmGetHotKey
ImmGetIMCCLockCount
ImmGetIMCCSize
ImmGetIMCLockCount
ImmGetIMEFileNameA
ImmGetIMEFileNameW
ImmGetImeInfoEx
ImmGetImeMenuItemsA
ImmGetImeMenuItemsW
ImmGetOpenStatus
ImmGetProperty
ImmGetRegisterWordStyleA
ImmGetRegisterWordStyleW
ImmGetStatusWindowPos
ImmGetVirtualKey
ImmIMPGetIMEA
ImmIMPGetIMEW
ImmIMPQueryIMEA
ImmIMPQueryIMEW
ImmIMPSetIMEA
ImmIMPSetIMEW
ImmInstallIMEA
ImmInstallIMEW
ImmIsIME
ImmIsUIMessageA
ImmIsUIMessageW
ImmLoadIME
ImmLoadLayout
ImmLockClientImc
ImmLockIMC
ImmLockIMCC
ImmLockImeDpi
ImmNotifyIME
ImmPenAuxInput
ImmProcessKey
ImmPutImeMenuItemsIntoMappedFile
ImmReSizeIMCC
ImmRegisterClient
ImmRegisterWordA
ImmRegisterWordW
ImmReleaseContext
ImmRequestMessageA
ImmRequestMessageW
ImmSendIMEMessageExA
ImmSendIMEMessageExW
ImmSendMessageToActiveDefImeWndW
ImmSetActiveContext
ImmSetActiveContextConsoleIME
ImmSetCandidateWindow
ImmSetCompositionFontA
ImmSetCompositionFontW
ImmSetCompositionStringA
ImmSetCompositionStringW
ImmSetCompositionWindow
ImmSetConversionStatus
ImmSetHotKey
ImmSetOpenStatus
ImmSetStatusWindowPos
ImmShowSoftKeyboard
ImmSimulateHotKey
ImmSystemHandler
ImmTranslateMessage
ImmUnlockClientImc
ImmUnlockIMC
ImmUnlockIMCC
ImmUnlockImeDpi
ImmUnregisterWordA
ImmUnregisterWordW
ImmWINNLSEnableIME
ImmWINNLSGetEnableStatus
ImmWINNLSGetIMEHotkey
Set

Sections

.text
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

726407322d2ce2ba8fc91b79b1567ebd

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

msvcrt

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 40KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 20KB - Virtual size: 40KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 44KB - Virtual size: 40KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 20KB - Virtual size: 40KB

.reloc
Size: 8KB - Virtual size: 6KB