3a8788abce8022f21f6a58ef3fcb7e46_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

3a8788abce8022f21f6a58ef3fcb7e46_JaffaCakes118
Size

256KB
MD5

3a8788abce8022f21f6a58ef3fcb7e46
SHA1

78396bccd9a101e5c7de43a4404f297d894179de
SHA256

45e96b4148af28c6079c72627f9ba4c8fa456c964e6129ead22d3aa46799245b
SHA512

69ac5107c18e672251bdfd07edb66ddc743016f4ca636f93c62d2af3c7e001c99518b5b677c4ac6f85efb249cd5665479cdcdb840efbf18d67f36fc4eb28e55b
SSDEEP

3072:TR69ecVI07DFTWtDx4w35t8UXQtoeMJzElg/ZiRPVudSMLk1JF8G7ANFiXztBetZ:TIVI0fFiRt8cQto1JzElg/Z6uSMs8mK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a8788abce8022f21f6a58ef3fcb7e46_JaffaCakes118

Files

3a8788abce8022f21f6a58ef3fcb7e46_JaffaCakes118
.dll windows:4 windows x86 arch:x86

0acc39652c2063ffc3d01d4ce29a9aa3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
lstrcpyA
GetModuleFileNameA
GetProfileStringA
GlobalFindAtomA
FreeLibrary
GetProcAddress
LoadLibraryA
SetErrorMode
_lopen
lstrcatA
_lclose
lstrcmpA
lstrcmpiA
lstrcpynA
_lread
_llseek
OpenFile
GlobalUnlock
GlobalLock
_lwrite
GetTempFileNameA
GetTempPathA
lstrlenA
GlobalAlloc
GlobalReAlloc
GlobalSize
GlobalHandle
IsDBCSLeadByte
SetHandleCount
CloseHandle
CreateFileA
GetLastError
DeleteFileA
FlushFileBuffers
SetFilePointer
LockFile
UnlockFile
ReadFile
SetEndOfFile
WriteFile
LCMapStringW
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar

user32

CharToOemA
wsprintfA
IsCharAlphaA
IsCharAlphaNumericA
CharNextA
LoadStringA
wvsprintfA
MessageBoxA
OemToCharA
CharPrevA
GetSystemMetrics
CharLowerA

msvcrt

_memicmp
_mbctoupper
strcpy
mbstowcs
wcstombs
_strnicmp
_ltoa
_ftol
atoi
_makepath
_splitpath
??2@YAPAXI@Z
??3@YAXPAX@Z
strstr
strchr
memcpy
memset
memcmp
qsort
sscanf
sprintf
memmove
atof
_ismbcprint
_fullpath
realloc
_adjust_fdiv
_itoa
strlen
memchr
strcmp
_isctype
toupper
calloc
fopen
free
atol
fclose
fputs
localtime
time
rename
_initterm
malloc

Exports

Exports

CanBuildIndex
CanFetchDataFileIndexInfo
CanFetchDataFileInfo
CanFetchNRecurringRecords
CanReadRangeOfValues
CanReadSortedOrder
CanRecognizeDataFile
CanUseFileLocking
CanUseRecordLocking
CloseDataFile
FetchDataFileIndexInfo
FetchDataFileInfo
FetchDatabaseName
FetchMemoField
FetchPersistentMemoField
FreeDataFileIndexInfo
FreeDataFileInfo
FreeDatabaseName
FreeMemoField
FreePersistentMemoField
InitDataFileAndIndexForReading2
InitDataFileForReadingVer11
InitPhysicalDatabase
LookupMatchingRecurringRecVer15
NRecurringRecordsToRead
OpenDataAndIndexFileIfRecogVer14
OpenDataFileAndIndexChoice
OpenDataFileIfRecognizedVer14
PhysDbVersionNumber
ReadFlatRecordVer15
ReadNextRecurringRecordVer15
TermDataFileForReading
TermPhysicalDatabase
UseFileLocking
UseRecordLocking

Sections

.text
Size: 155KB - Virtual size: 154KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 74KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0acc39652c2063ffc3d01d4ce29a9aa3

Headers

File Characteristics

Imports

kernel32

user32

msvcrt

Exports

Exports

Sections

.text Size: 155KB - Virtual size: 154KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 74KB - Virtual size: 76KB

.rsrc Size: 7KB - Virtual size: 8KB

.reloc Size: 14KB - Virtual size: 14KB

.text
Size: 155KB - Virtual size: 154KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 74KB - Virtual size: 76KB

.rsrc
Size: 7KB - Virtual size: 8KB

.reloc
Size: 14KB - Virtual size: 14KB