fbd66ae4a3c43acd63ca5c445d44c76b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fbd66ae4a3c43acd63ca5c445d44c76b_JaffaCakes118
Size

91KB
MD5

fbd66ae4a3c43acd63ca5c445d44c76b
SHA1

a7eba980491ca941f613f90c755a0d41ccfb0191
SHA256

9d754fbd6110ce0c3891a4f44a078c6d0962801783d9c657b8e52529f7159383
SHA512

0e1090d4a6455a6e058f5b351af2e6bf30fde50f0b662705aa583fdb15c01457088b503a4812ecb70d5321c170c954107104e7f100d00fb99eec0a92049a4339
SSDEEP

1536:ytbC2kAApV1lnqToen6An81t8CJliF6NlGSc48cxwDfihuWOneZJ1IsHun:yRpACQ1uC2cc48ewjihuvneZJ17un

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fbd66ae4a3c43acd63ca5c445d44c76b_JaffaCakes118

Files

fbd66ae4a3c43acd63ca5c445d44c76b_JaffaCakes118
.dll windows:4 windows x86 arch:x86

80876ff98f7473ed2204be064fb12a61

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetTickCount
GetLocalTime
MapViewOfFile
CreateFileMappingA
HeapFree
GetProcessHeap
HeapAlloc
UnmapViewOfFile
GetModuleHandleA
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
PeekNamedPipe
WaitForMultipleObjects
ReleaseMutex
OpenEventA
SetErrorMode
SetUnhandledExceptionFilter
lstrcpynA
LocalSize
Process32Next
lstrlenA
Process32First
CreateToolhelp32Snapshot
GetCurrentThreadId
MoveFileExA
GetSystemDirectoryA
lstrcmpiA
DeviceIoControl
SleepEx
ExitThread
SetEvent
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
DeleteFileA
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
GetProcAddress
LoadLibraryA
InterlockedExchange
CancelIo
lstrcatA
FreeLibrary
GetVersionExA
CreateDirectoryA
GetFileAttributesA
CreateProcessA
GetDiskFreeSpaceExA
GetVolumeInformationA
GetLogicalDriveStringsA
FindClose
LocalFree
LocalReAlloc
FindFirstFileA
RemoveDirectoryA
CreateFileA
OpenProcess
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetCurrentProcess
SetLastError
WriteFile
ReadFile

ws2_32

connect
htons
gethostbyname
socket
recv
select
send
gethostname
getsockname
inet_addr
WSAIoctl
sendto
WSASocketA
inet_ntoa
closesocket
WSAStartup
WSACleanup
setsockopt

user32

GetCursorInfo
GetCursorPos
ReleaseDC
SetProcessWindowStation
GetDC
SetRect
GetSystemMetrics
GetClipboardData
OpenWindowStationA
ExitWindowsEx
GetWindowThreadProcessId
GetDesktopWindow
IsWindowVisible
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
EnumWindows
SetCursorPos
WindowFromPoint
SetCapture
MapVirtualKeyA
keybd_event
SystemParametersInfoA
SendMessageA
BlockInput
DestroyCursor
LoadCursorA
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
GetKeyNameTextA
GetActiveWindow
GetWindowTextA
CharNextA
wsprintfA
GetInputState
GetForegroundWindow
CloseDesktop
GetUserObjectInformationA
OpenInputDesktop
GetThreadDesktop
OpenDesktopA
PostMessageA
CreateWindowExA
CloseWindow
IsWindow
mouse_event
SetThreadDesktop

gdi32

DeleteObject
DeleteDC
CreateDIBSection
GetDIBits
CreateCompatibleBitmap
BitBlt
CreateCompatibleDC
SelectObject

advapi32

OpenServiceA
QueryServiceStatus
ControlService
DeleteService
RegOpenKeyExA
RegQueryValueA
RegCloseKey
OpenSCManagerA
CloseServiceHandle
StartServiceA
SetServiceStatus
RegisterServiceCtrlHandlerA
RegSetKeySecurity
InitializeSecurityDescriptor
AllocateAndInitializeSid
GetLengthSid
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
RegOpenKeyA
CloseEventLog
ClearEventLogA
OpenEventLogA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCreateKeyExA
FreeSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl

shell32

SHGetFileInfoA

shlwapi

SHDeleteKeyA

msvcrt

_strcmpi
ceil
_ftol
strstr
memcmp
strchr
malloc
strcmp
strlen
free
strrchr
memmove
strncat
realloc
atoi
wcstombs
_beginthreadex
calloc
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
__CxxFrameHandler
memcpy
??3@YAXPAX@Z
_except_handler3
??2@YAPAXI@Z
_CxxThrowException
memset
_strnset
_itoa
_strnicmp
strcpy

msvcp60

?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

imm32

ImmReleaseContext
ImmGetContext
ImmGetCompositionStringA

wininet

InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle

avicap32

capCreateCaptureWindowA

msvfw32

ICSeqCompressFrame
ICSendMessage
ICOpen
ICClose
ICCompressorFree
ICSeqCompressFrameEnd
ICSeqCompressFrameStart

psapi

GetModuleFileNameExA
EnumProcessModules

Exports

Exports

AerviceMaio
ServiceMain
servicemain

Sections

.ABCclim
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

80876ff98f7473ed2204be064fb12a61

Headers

File Characteristics

Imports

kernel32

ws2_32

user32

gdi32

advapi32

shell32

shlwapi

msvcrt

msvcp60

imm32

wininet

avicap32

msvfw32

psapi

Exports

Exports

Sections

.ABCclim Size: 63KB - Virtual size: 63KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 8KB - Virtual size: 9KB

.rsrc Size: 1024B - Virtual size: 888B

.reloc Size: 5KB - Virtual size: 5KB

.ABCclim
Size: 63KB - Virtual size: 63KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 8KB - Virtual size: 9KB

.rsrc
Size: 1024B - Virtual size: 888B

.reloc
Size: 5KB - Virtual size: 5KB