2ace856d366af8279d3466b4d0509d2d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2ace856d366af8279d3466b4d0509d2d_JaffaCakes118
Size

38KB
MD5

2ace856d366af8279d3466b4d0509d2d
SHA1

1918277031b7603351d7f711b1e22ff031b341b5
SHA256

ff35364e3356111eb61a725b20c7d6d82260803ca87af518d5c9d4026050ed17
SHA512

3eaa28336e399a4a9c17817372e94889d8872b528bd3df1844d07ce77dae4321fd2db166194a689c9a7a1a8e19d91f50fff9388ff6773385de5d43995aaf5acc
SSDEEP

768:qBbVyA4Ci9wFdd/ksscSAVhSCBGRqUOmWh4TBt3mG1y6:qL5SwFdRjVhdBJUrWh4TVX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ace856d366af8279d3466b4d0509d2d_JaffaCakes118

Files

2ace856d366af8279d3466b4d0509d2d_JaffaCakes118
.dll windows:4 windows x86 arch:x86

8eb5ab0dcb6fcc26b1f9a95ff9c6527f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualProtect
GetCurrentProcessId
GetProcessHeap
HeapAlloc
OpenProcess
GetLastError
WideCharToMultiByte
lstrcatA
WriteProcessMemory
GetTempPathA
ReleaseMutex
CreateMutexA
GetSystemDirectoryA
lstrcpynA
ReadProcessMemory
SetThreadPriority
VirtualProtectEx
CopyFileA
DeviceIoControl
TerminateThread
GetModuleHandleA
CreateFileA
ReadFile
CloseHandle
GetFileSize
GetCurrentProcess
TerminateProcess
LoadLibraryA
GetProcAddress
GetModuleFileNameA
Sleep
GetTickCount
CreateThread

user32

GetForegroundWindow
GetClassNameW
wsprintfA
ToAscii
GetKeyboardState
GetWindow

gdi32

GetDeviceCaps
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteDC
DeleteObject
CreateDCA
BitBlt

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegEnumKeyExA

msvcrt

_onexit
wcsstr
wcsncat
__dllonexit
exit
_strcmpi
_strupr
_strdup
_strlwr
memset
??2@YAPAXI@Z
strcpy
strcat
strlen
strncpy
rand
srand
time
strstr
atoi
memcpy
strrchr
free
_stricmp
malloc
??3@YAXPAX@Z
_except_handler3
wcscat
wcscpy
wcslen
isspace
isalnum
strchr
_vsnprintf
realloc
isdigit
isalpha
wcscmp
mbstowcs

gdiplus

GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipDisposeImage
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusStartup

msvcp60

??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ

wsock32

shutdown
send
closesocket
recv
connect
htons
socket
WSAStartup
gethostbyname

Sections

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8eb5ab0dcb6fcc26b1f9a95ff9c6527f

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

msvcrt

gdiplus

msvcp60

wsock32

Sections

.bss Size: - Virtual size: 2KB

.data Size: 33KB - Virtual size: 32KB

.CRT Size: 512B - Virtual size: 8B

.reloc Size: 3KB - Virtual size: 2KB

.bss
Size: - Virtual size: 2KB

.data
Size: 33KB - Virtual size: 32KB

.CRT
Size: 512B - Virtual size: 8B

.reloc
Size: 3KB - Virtual size: 2KB