0a3ea5ecd7e29cd66da02a17ff6e86a4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0a3ea5ecd7e29cd66da02a17ff6e86a4_JaffaCakes118
Size

196KB
MD5

0a3ea5ecd7e29cd66da02a17ff6e86a4
SHA1

fcbe85c80dd53de1ff704d6366a3eb4b2543d7d4
SHA256

51c3a6714cb40de2f806933751ecae31a595f800f538575b1bfedcaddc05a7b4
SHA512

cb0a4676c7e839446d5b579b619bdbf52593a38cfaddaede64d4ac3ca9cf40573e984209005c0bde826f639fcf4e23b5d5fd73984059425d9afec146675b472f
SSDEEP

3072:S0GfRAFBpxBkDogzloKDfs4lI15zUbHMu1DJVVbslO3774z/zb8tLPGOAYP:bfxBJMloKDfJlI15whD5R37he8P

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a3ea5ecd7e29cd66da02a17ff6e86a4_JaffaCakes118

Files

0a3ea5ecd7e29cd66da02a17ff6e86a4_JaffaCakes118
.dll windows:4 windows x86 arch:x86

22b7840a758286f6a0d05735f274d78b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

dui70

?_InheritProperties@Element@DirectUI@@AAEXXZ
?_InheritProperties@Element@DirectUI@@AAEXXZ
?_UpdatePropertyInCache@Element@DirectUI@@AAEXPBUPropertyInfo@2@@Z

advapi32

RegCreateKeyA
RegDeleteValueA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegEnumValueA
RegCloseKey

kernel32

LoadLibraryA
FindClose
FindFirstFileA
UnmapViewOfFile
GetLastError
MapViewOfFile
CreateFileMappingA
GetFileSize
lstrcmpA
GetTempFileNameA
GetTempPathA
lstrlenA
SetFilePointer
ReadFile
WriteFile
SetLastError
SetFileAttributesA
CopyFileA
GetPrivateProfileStringA
FindNextFileA
OpenEventA
GetVolumeInformationA
GetDriveTypeA
lstrcatA
GetSystemDirectoryA
GetModuleFileNameA
Sleep
ExitProcess
WaitForSingleObject
ResumeThread
TerminateProcess
GetModuleHandleA
FreeLibrary
CreateDirectoryA
GetEnvironmentVariableA
GetFileTime
GetSystemTime
SetFileTime
GetTickCount
GetComputerNameA
GetLocalTime
GetTempPathW
GetWindowsDirectoryW
GetEnvironmentVariableW
GetComputerNameW
GetTimeZoneInformation
MultiByteToWideChar
lstrcatW
lstrlenW
FileTimeToSystemTime
CreateMutexA
ReleaseMutex
OutputDebugStringA
InterlockedIncrement
InterlockedDecrement
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetStringTypeW
GetStringTypeExA
DeleteFileA
lstrcpyA
CreateFileA
GetFileInformationByHandle
CloseHandle
GetFileAttributesA
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetWindowsDirectoryA
IsBadCodePtr
IsBadReadPtr
GetOEMCP
GetACP
GetCPInfo
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
WideCharToMultiByte
SetUnhandledExceptionFilter
FlushFileBuffers
GetCurrentProcess
GetStartupInfoA
GetStdHandle
HeapFree
GetFileType
RaiseException
RtlUnwind
CreateThread
TlsSetValue
TlsGetValue
GetCommandLineA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
GetCurrentThreadId
TlsAlloc
TlsFree
SetStdHandle
SetEndOfFile
SetHandleCount
WriteProcessMemory
VirtualAllocEx
VirtualProtectEx

ntdll

RtlSizeHeap
RtlAllocateHeap
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlExitUserThread
RtlReAllocateHeap
RtlInitializeCriticalSection
RtlDeleteCriticalSection
NtdllDefWindowProc_A

rpcrt4

UuidToStringA
UuidCreate
RpcStringFreeA

user32

RegisterClassExA
CreateWindowExA
CharLowerBuffA
wsprintfA
wsprintfW
GetMessageA
TranslateMessage
DispatchMessageA

ws2

inet_ntoa
gethostbyname
WSAStartup
WSACleanup

msvcp60

?pbackfail@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAEHH@Z

Exports

Exports

Entry
InstallM
InstallS

Sections

.text
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rc_it
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

22b7840a758286f6a0d05735f274d78b

Headers

File Characteristics

Imports

dui70

advapi32

kernel32

ntdll

rpcrt4

user32

ws2

msvcp60

Exports

Exports

Sections

.text Size: 128KB - Virtual size: 128KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 26KB - Virtual size: 26KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 10KB - Virtual size: 10KB

.rc_it Size: 8KB - Virtual size: 8KB

.text
Size: 128KB - Virtual size: 128KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 26KB - Virtual size: 26KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 10KB - Virtual size: 10KB

.rc_it
Size: 8KB - Virtual size: 8KB