2f1b17916e73bc05ab89b0aee7891da4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2f1b17916e73bc05ab89b0aee7891da4_JaffaCakes118
Size

233KB
MD5

2f1b17916e73bc05ab89b0aee7891da4
SHA1

c4b2e4258f9225b52258585b075300c1ee456fef
SHA256

06402a505fd2e6aa5d63ad2f1926d2c8aa8782d9eea7e14803ce7f79db1544d7
SHA512

eedcb338f7a86f716d9d9ed85404b249472fdfb26028d19e20c2d95002c7c69871e02339995fa204e6d7c7874e750de84527782e21b12cef49188d07015a559f
SSDEEP

6144:eoP7ph/0GzA8DGZJK9Uae1paOEdpPOXMt6ONoJQ:eoP7phzA8DC/UbhOJQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f1b17916e73bc05ab89b0aee7891da4_JaffaCakes118

Files

2f1b17916e73bc05ab89b0aee7891da4_JaffaCakes118
.dll windows:4 windows x86 arch:x86

36247f41286884c6798bf13c6bd8e1ba

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ole32

CoGetContextToken
StgCreateDocfileOnILockBytes

kernel32

MoveFileA
GetDateFormatA
VirtualAlloc
IsBadReadPtr
LocalAlloc
ResetEvent
SetEndOfFile
GetLastError
ReadFile
LoadLibraryA
GetCommandLineW
GetModuleHandleA
ExitThread
ExitProcess
GetVersionExA
GetProcAddress
GetACP
GlobalAlloc

msvcrt

wcsncmp
pow
srand
_acmdln
cos
rand
wcscspn

user32

GetKeyNameTextA
GetKeyState
GetIconInfo

shell32

SHGetFolderPathA
SHGetFileInfoA
SHFileOperationA

gdi32

BitBlt
GetClipBox

comdlg32

FindTextA

shlwapi

SHEnumValueA
SHDeleteKeyA
PathGetCharTypeA
PathIsDirectoryA
SHQueryValueExA
SHGetValueA
SHQueryInfoKeyA
PathIsContentTypeA

comctl32

ImageList_DragShowNolock
ImageList_GetBkColor
ImageList_DrawEx
ImageList_Create
ImageList_Write

advapi32

RegDeleteKeyA
GetUserNameA
RegEnumKeyA
RegEnumValueA

oleaut32

SafeArrayPtrOfIndex
GetErrorInfo
VariantChangeType
SafeArrayGetUBound
SafeArrayUnaccessData
SafeArrayGetElement
RegisterTypeLib
SafeArrayCreate

version

GetFileVersionInfoSizeA
VerFindFileA

Sections

CODE
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 734B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: 1024B - Virtual size: 748B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gdata
Size: 158KB - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

36247f41286884c6798bf13c6bd8e1ba

Headers

File Characteristics

Imports

ole32

kernel32

msvcrt

user32

shell32

gdi32

comdlg32

shlwapi

comctl32

advapi32

oleaut32

version

Sections

CODE Size: 57KB - Virtual size: 57KB

.rdata Size: 1024B - Virtual size: 734B

.data Size: 8KB - Virtual size: 8KB

.adata Size: 1024B - Virtual size: 748B

.gdata Size: 158KB - Virtual size: 226KB

.bdata Size: 3KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 996B

.reloc Size: 1KB - Virtual size: 1KB

CODE
Size: 57KB - Virtual size: 57KB

.rdata
Size: 1024B - Virtual size: 734B

.data
Size: 8KB - Virtual size: 8KB

.adata
Size: 1024B - Virtual size: 748B

.gdata
Size: 158KB - Virtual size: 226KB

.bdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 996B

.reloc
Size: 1KB - Virtual size: 1KB