38a3ab671d8625954d436dee5f862046_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

38a3ab671d8625954d436dee5f862046_JaffaCakes118
Size

765KB
MD5

38a3ab671d8625954d436dee5f862046
SHA1

b6ae6ddaeb9d30c940091d0ea32cf3c91a016e70
SHA256

b737c9f5d8d9468f107f2ca03b8cac6cfd8d1ff348bccbcb297d56522fb82a36
SHA512

96cc3c4360a99ec4b5ce2324260421075608a96ecbf233f2ad29ee9c13d07a2fe34109eff2a18d9b8132e457cc1f6052338e6d78682178a654d1a21333e241c0
SSDEEP

12288:g9VDeuKhb5aeL+3N9aCntH6xsVD0Y7gjfRDt6z/GS1ssB0LAK/iFIfYK+pgJ:g9V/Khb5aeL+dsCnNuGafRDtE/GSeLAA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
38a3ab671d8625954d436dee5f862046_JaffaCakes118

Files

38a3ab671d8625954d436dee5f862046_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a1cf413ebf2726f6ccef3a4416f6bd05

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Documents and Settings\Berry\My Documents\Visual Studio 2008\Projects\iBattler Loader45\Release\Hack Loader.pdb

Imports

kernel32

lstrcmpiA
CloseHandle
CreateRemoteThread
WaitForSingleObject
ResumeThread
SetThreadContext
GetThreadContext
WriteProcessMemory
GetProcAddress
VirtualAllocEx
lstrlenA
GetExitCodeThread
IsBadReadPtr
VirtualProtect
VirtualAlloc
SuspendThread
VirtualFree
GetPrivateProfileStringA
WritePrivateProfileStringA
GetModuleFileNameA
GetVolumeInformationA
GetSystemDirectoryA
InterlockedDecrement
FindFirstFileA
CreateFileA
lstrcpyA
GetLastError
Sleep
CreateThread
GetCurrentDirectoryA
WriteFile
HeapCreate
HeapReAlloc
ReadFile
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
GetModuleHandleA
Module32First
Module32Next
GetProcessId
Module32FirstW
Module32NextW
Process32First
Process32Next
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
OpenProcess
FormatMessageA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
DeleteCriticalSection
GetFileType
GetStdHandle
LCMapStringW
LCMapStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
InitializeCriticalSectionAndSpinCount
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
HeapFree
GetProcessHeap
RtlUnwind
HeapAlloc
GetModuleHandleW
ExitProcess
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
GetCPInfo
InterlockedIncrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection

user32

DestroyWindow
MessageBoxA
DialogBoxParamA
CreateDialogParamA
GetForegroundWindow
UpdateWindow
TranslateMessage
SendDlgItemMessageA
SetDlgItemTextA
GetMessageA
DispatchMessageA
EnableWindow
GetDlgItemTextA
SendMessageA
GetDlgItem
wsprintfW
FindWindowA
PostQuitMessage

advapi32

CryptHashData
CryptAcquireContextA
CryptCreateHash
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegOpenKeyA

shell32

ShellExecuteA

ole32

CoUninitialize
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket

oleaut32

VariantClear
SysFreeString
SysAllocString

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

urlmon

URLOpenBlockingStreamA

ws2_32

select
recv
closesocket
connect
freeaddrinfo
getaddrinfo
socket
send
WSAStartup

Sections

.text
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 632KB - Virtual size: 632KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a1cf413ebf2726f6ccef3a4416f6bd05

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

version

urlmon

ws2_32

Sections

.text Size: 108KB - Virtual size: 108KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 5KB - Virtual size: 13KB

.rsrc Size: 632KB - Virtual size: 632KB

.text
Size: 108KB - Virtual size: 108KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 5KB - Virtual size: 13KB

.rsrc
Size: 632KB - Virtual size: 632KB