486ac30cc21127c6c77bad0683241897_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

486ac30cc21127c6c77bad0683241897_JaffaCakes118
Size

6.0MB
MD5

486ac30cc21127c6c77bad0683241897
SHA1

21e04bc008bde17a789189f1632ed609eb236612
SHA256

1755c81ea0eee5c896badd33adbb439f7ec6d21b7ca997cd0049101ff4895ef6
SHA512

5376e58c1132ccaaa8ae342bde7f9004dce42835fbd94a9a9292f9ac4ed74d6523b170799ece836da659feabd156a60aad15e498aad365d58bd4e9218817030f
SSDEEP

98304:yGGG3TGub/1fGQV2IltIdrbxsHP9rLMNG/JClv2RlcgpWtjot:mG3TGElGfaIZqmNAssRlcg0t0t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
486ac30cc21127c6c77bad0683241897_JaffaCakes118

Files

486ac30cc21127c6c77bad0683241897_JaffaCakes118
.dll windows:5 windows x86 arch:x86

b3588eea084e790e2d5c164b2c8a81e8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey
OpenProcessToken
GetTokenInformation
RegSetValueExA
RegCreateKeyExA
CryptExportKey
CryptAcquireContextW
CryptSetProvParam
CryptReleaseContext
CryptGenRandom
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptGenKey
CryptDestroyKey
CryptGetUserKey
IsValidSecurityDescriptor
LookupPrivilegeValueW
AdjustTokenPrivileges
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
SetSecurityDescriptorSacl
RegQueryValueExW
RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegOpenCurrentUser
RegEnumValueW
RegOpenKeyExW
RegEnumKeyExW
RegSetValueExW
CryptGetHashParam
CredFree
RegEnumKeyExA
CryptAcquireContextA
CryptCreateHash
RegEnumValueA
CredEnumerateA
CryptDestroyHash
CryptHashData
DeregisterEventSource
RegisterEventSourceA
FreeSid
SetSecurityInfo
AllocateAndInitializeSid
GetSecurityInfo
SetEntriesInAclA
GetUserNameW
ReportEventA

user32

DispatchMessageW
LoadCursorW
GetKeyboardState
TranslateMessage
CallNextHookEx
GetKeyState
GetMessageW
CloseClipboard
GetWindowTextW
DrawIcon
GetIconInfo
ToUnicodeEx
GetWindowThreadProcessId
DefWindowProcW
SetClipboardViewer
SendMessageW
UnhookWindowsHookEx
OpenClipboard
SetWindowsHookExW
CreateWindowExW
GetCursorPos
GetProcessWindowStation
MessageBoxA
GetUserObjectInformationW
GetMessageA
MapVirtualKeyW
DispatchMessageA
wsprintfA
CharLowerW
GetForegroundWindow
RegisterClassExW
GetKeyboardLayout
GetAsyncKeyState
MapVirtualKeyA
IsCharAlphaNumericW
GetClipboardData

psapi

GetProcessMemoryInfo
GetModuleFileNameExW
GetModuleFileNameExA
EnumProcessModules

ws2_32

inet_addr
WSAIoctl
getpeername
bind
connect
htonl
htons
listen
recv
send
setsockopt
WSAEnumProtocolsW
WSASetLastError
getsockopt
WSASocketW
WSASendTo
getsockname
WSARecvFrom
WSARecv
ioctlsocket
select
GetNameInfoW
GetAddrInfoW
FreeAddrInfoW
WSADuplicateSocketW
WSASend
ntohl
__WSAFDIsSet
recvfrom
shutdown
socket
closesocket
WSCGetProviderPath
ntohs
gethostname
WSAGetLastError
inet_ntoa
WSAStartup
gethostbyname

gdi32

BitBlt
GetDeviceCaps
CreateDCW
DeleteObject
SelectObject
CreateCompatibleBitmap
DeleteDC
GetDIBits
CreateCompatibleDC

ntdll

RtlUnwind
memmove
wcschr
_stricmp
strncmp
memchr
strncpy
strstr
_aullrem
strcspn
wcsstr
wcsrchr
RtlNtStatusToDosError
VerSetConditionMask
NtUnmapViewOfSection
ZwClose
NtCreateSection
NtQueryVirtualMemory

winscard

SCardEstablishContext
SCardFreeMemory
SCardDisconnect
SCardListReadersA
SCardConnectA

kernel32

DecodePointer
GetModuleHandleExW
EncodePointer
GetCPInfo
IsProcessorFeaturePresent
SetStdHandle
SetFileAttributesW
GetConsoleCP
SystemTimeToTzSpecificLocalTime
ReadConsoleInputA
RaiseException
IsValidCodePage
GetACP
GetOEMCP
GetDriveTypeW
FindFirstFileExW
GetStringTypeW
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
UnhandledExceptionFilter
GetDateFormatW
GetTimeFormatW
CompareStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetEnvironmentVariableA
FlushConsoleInputBuffer
FindClose
GlobalMemoryStatus
GetWindowsDirectoryA
DebugBreak
ReadConsoleInputW
GetConsoleCursorInfo
FillConsoleOutputAttribute
SetConsoleCursorInfo
GetConsoleScreenBufferInfo
FillConsoleOutputCharacterW
WriteConsoleW
SetConsoleCursorPosition
SetConsoleMode
ReadConsoleW
HeapAlloc
HeapFree
GetCurrentThread
GetProcessHeap
GetProcAddress
LoadLibraryA
GetModuleHandleA
ExitProcess
GetEnvironmentVariableW
CreateFileA
lstrcmpA
lstrlenA
GetCurrentProcess
SetEnvironmentVariableW
GetEnvironmentStringsW
WaitForSingleObject
ExpandEnvironmentStringsA
WriteFile
Sleep
FormatMessageW
lstrcatA
ExitThread
FlushFileBuffers
GetLastError
GetModuleFileNameA
FreeEnvironmentStringsW
OutputDebugStringA
CloseHandle
GetCurrentProcessId
LocalFree
CreateThread
GetNativeSystemInfo
GetVolumeInformationA
GetVersionExW
GetEnvironmentVariableA
SetUnhandledExceptionFilter
SetEvent
GetModuleHandleW
IsBadReadPtr
GetCommandLineA
TerminateThread
IsBadCodePtr
SetLastError
DisableThreadLibraryCalls
SetProcessWorkingSetSize
GetCurrentThreadId
HeapDestroy
HeapCreate
HeapReAlloc
FileTimeToDosDateTime
SetFilePointer
FreeLibrary
LoadLibraryW
ReadFile
GetTempFileNameA
FileTimeToLocalFileTime
GetFileInformationByHandle
GetTempPathA
DeleteFileA
SystemTimeToFileTime
GetTickCount
LocalAlloc
GetVersion
GetSystemTime
OpenProcess
WaitForMultipleObjects
GetFileSize
VirtualFree
CreateRemoteThread
GetModuleFileNameW
CreateFileW
lstrcmpiA
VirtualAlloc
VirtualAllocEx
lstrcmpiW
WriteProcessMemory
SuspendThread
ResumeThread
lstrcpyW
Process32FirstW
Module32FirstW
Process32NextW
CreateToolhelp32Snapshot
Module32NextW
lstrcpyA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
SetFileTime
GetFileTime
GlobalSize
GlobalLock
GlobalUnlock
VerifyVersionInfoW
CreateEventW
GlobalAlloc
GlobalFree
IsBadStringPtrA
GetExitCodeThread
InitializeCriticalSection
LeaveCriticalSection
SetThreadPriority
EnterCriticalSection
DeleteCriticalSection
ExpandEnvironmentStringsW
FormatMessageA
WideCharToMultiByte
IsBadWritePtr
CreateMutexW
ReleaseMutex
GetFullPathNameW
GetFullPathNameA
HeapCompact
TryEnterCriticalSection
SetEndOfFile
QueryPerformanceCounter
InterlockedCompareExchange
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
UnlockFileEx
GetSystemTimeAsFileTime
GetFileAttributesA
HeapValidate
GetFileAttributesW
MultiByteToWideChar
GetTempPathW
HeapSize
LockFileEx
GetDiskFreeSpaceW
CreateFileMappingA
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
GetVersionExA
DeleteFileW
AreFileApisANSI
GetThreadContext
CreateProcessW
TerminateProcess
QueryPerformanceFrequency
CreateProcessA
GetSystemDirectoryA
SetThreadContext
FlushInstructionCache
VirtualProtect
VirtualQuery
InterlockedExchangeAdd
GlobalMemoryStatusEx
GetThreadTimes
GetFileType
GetStdHandle
GetTimeZoneInformation
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ReleaseSemaphore
CreateSemaphoreA
OpenThread
GetConsoleMode
GetProcessIoCounters
Process32First
GetProcessTimes
VerifyVersionInfoA
FileTimeToSystemTime
GetCurrentDirectoryW
Process32Next
SetCurrentDirectoryW
SetConsoleTitleW
GetConsoleTitleW
SetErrorMode
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
CreateEventA
ResetEvent
CreateSemaphoreW
InterlockedExchange
SetConsoleCtrlHandler
UnregisterWait
PeekNamedPipe
GetNamedPipeHandleStateA
ConnectNamedPipe
CreateNamedPipeW
WaitNamedPipeW
CreateNamedPipeA
RegisterWaitForSingleObject
SetNamedPipeHandleState
QueueUserWorkItem
DuplicateHandle
SwitchToThread
SetInformationJobObject
CreateJobObjectW
AssignProcessToJobObject
GetExitCodeProcess
UnregisterWaitEx
LCMapStringW
SetHandleInformation
LoadLibraryExW
GetStartupInfoW
MoveFileExW
SetFilePointerEx
CreateDirectoryW
CopyFileW
CreateHardLinkW
RemoveDirectoryW
DeviceIoControl
ReadDirectoryChangesW
GetLongPathNameW
GetShortPathNameW
CancelIo
WriteConsoleInputW
GetNumberOfConsoleInputEvents
SetConsoleTextAttribute

shell32

SHGetFolderPathW

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance

shlwapi

StrStrIW
StrChrA
PathAppendW
PathRemoveExtensionW
PathFindFileNameW

wininet

InternetReadFile
InternetCrackUrlA
HttpQueryInfoA
HttpOpenRequestA
InternetSetOptionA
HttpSendRequestA
InternetOpenA
InternetConnectA
InternetCloseHandle
InternetQueryOptionA

crypt32

CertCloseStore
CryptAcquireCertificatePrivateKey
CryptExportPublicKeyInfoEx
CertOpenStore
CryptDecodeObjectEx
CertCreateSelfSignCertificate
CertFindExtension
CertGetIntendedKeyUsage
CryptBinaryToStringA
CertFreeCertificateContext
CertAddCertificateContextToStore
CertStrToNameW
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CryptEncodeObjectEx
CryptSignAndEncodeCertificate
CryptEncodeObject
CryptProtectData
CryptUnprotectData

netapi32

NetShareEnum
NetServerDiskEnum
NetUserEnum
NetApiBufferFree
NetUserGetInfo
NetServerEnum

iphlpapi

ConvertInterfaceIndexToLuid
GetAdaptersAddresses
ConvertInterfaceLuidToNameW

winmm

timeGetTime

userenv

GetUserProfileDirectoryW

oleaut32

GetErrorInfo

Exports

Exports

uv_accept
uv_async_init
uv_async_send
uv_backend_fd
uv_backend_timeout
uv_barrier_destroy
uv_barrier_init
uv_barrier_wait
uv_buf_init
uv_cancel
uv_chdir
uv_check_init
uv_check_start
uv_check_stop
uv_close
uv_cond_broadcast
uv_cond_destroy
uv_cond_init
uv_cond_signal
uv_cond_timedwait
uv_cond_wait
uv_cpu_info
uv_cwd
uv_default_loop
uv_disable_stdio_inheritance
uv_dlclose
uv_dlerror
uv_dlopen
uv_dlsym
uv_err_name
uv_exepath
uv_fileno
uv_free_cpu_info
uv_free_interface_addresses
uv_freeaddrinfo
uv_fs_access
uv_fs_chmod
uv_fs_chown
uv_fs_close
uv_fs_copyfile
uv_fs_event_getpath
uv_fs_event_init
uv_fs_event_start
uv_fs_event_stop
uv_fs_fchmod
uv_fs_fchown
uv_fs_fdatasync
uv_fs_fstat
uv_fs_fsync
uv_fs_ftruncate
uv_fs_futime
uv_fs_link
uv_fs_lstat
uv_fs_mkdir
uv_fs_mkdtemp
uv_fs_open
uv_fs_poll_getpath
uv_fs_poll_init
uv_fs_poll_start
uv_fs_poll_stop
uv_fs_read
uv_fs_readlink
uv_fs_realpath
uv_fs_rename
uv_fs_req_cleanup
uv_fs_rmdir
uv_fs_scandir
uv_fs_scandir_next
uv_fs_sendfile
uv_fs_stat
uv_fs_symlink
uv_fs_unlink
uv_fs_utime
uv_fs_write
uv_get_free_memory
uv_get_osfhandle
uv_get_process_title
uv_get_total_memory
uv_getaddrinfo
uv_getnameinfo
uv_getrusage
uv_guess_handle
uv_handle_size
uv_has_ref
uv_hrtime
uv_idle_init
uv_idle_start
uv_idle_stop
uv_if_indextoiid
uv_if_indextoname
uv_inet_ntop
uv_inet_pton
uv_interface_addresses
uv_ip4_addr
uv_ip4_name
uv_ip6_addr
uv_ip6_name
uv_is_active
uv_is_closing
uv_is_readable
uv_is_writable
uv_key_create
uv_key_delete
uv_key_get
uv_key_set
uv_kill
uv_listen
uv_loadavg
uv_loop_alive
uv_loop_close
uv_loop_configure
uv_loop_delete
uv_loop_fork
uv_loop_init
uv_loop_new
uv_loop_size
uv_mutex_destroy
uv_mutex_init
uv_mutex_init_recursive
uv_mutex_lock
uv_mutex_trylock
uv_mutex_unlock
uv_now
uv_once
uv_os_free_passwd
uv_os_get_passwd
uv_os_getenv
uv_os_gethostname
uv_os_getpid
uv_os_getppid
uv_os_homedir
uv_os_setenv
uv_os_tmpdir
uv_os_unsetenv
uv_pipe_bind
uv_pipe_chmod
uv_pipe_connect
uv_pipe_getpeername
uv_pipe_getsockname
uv_pipe_init
uv_pipe_open
uv_pipe_pending_count
uv_pipe_pending_instances
uv_pipe_pending_type
uv_poll_init
uv_poll_init_socket
uv_poll_start
uv_poll_stop
uv_prepare_init
uv_prepare_start
uv_prepare_stop
uv_print_active_handles
uv_print_all_handles
uv_process_kill
uv_queue_work
uv_read_start
uv_read_stop
uv_recv_buffer_size
uv_ref
uv_replace_allocator
uv_req_size
uv_resident_set_memory
uv_run
uv_rwlock_destroy
uv_rwlock_init
uv_rwlock_rdlock
uv_rwlock_rdunlock
uv_rwlock_tryrdlock
uv_rwlock_trywrlock
uv_rwlock_wrlock
uv_rwlock_wrunlock
uv_sem_destroy
uv_sem_init
uv_sem_post
uv_sem_trywait
uv_sem_wait
uv_send_buffer_size
uv_set_process_title
uv_setup_args
uv_shutdown
uv_signal_init
uv_signal_start
uv_signal_start_oneshot
uv_signal_stop
uv_spawn
uv_stop
uv_stream_set_blocking
uv_strerror
uv_tcp_bind
uv_tcp_connect
uv_tcp_getpeername
uv_tcp_getsockname
uv_tcp_init
uv_tcp_init_ex
uv_tcp_keepalive
uv_tcp_nodelay
uv_tcp_open
uv_tcp_simultaneous_accepts
uv_thread_create
uv_thread_equal
uv_thread_join
uv_thread_self
uv_timer_again
uv_timer_get_repeat
uv_timer_init
uv_timer_set_repeat
uv_timer_start
uv_timer_stop
uv_translate_sys_error
uv_try_write
uv_tty_get_winsize
uv_tty_init
uv_tty_reset_mode
uv_tty_set_mode
uv_udp_bind
uv_udp_getsockname
uv_udp_init
uv_udp_init_ex
uv_udp_open
uv_udp_recv_start
uv_udp_recv_stop
uv_udp_send
uv_udp_set_broadcast
uv_udp_set_membership
uv_udp_set_multicast_interface
uv_udp_set_multicast_loop
uv_udp_set_multicast_ttl
uv_udp_set_ttl
uv_udp_try_send
uv_unref
uv_update_time
uv_uptime
uv_version
uv_version_string
uv_walk
uv_write
uv_write2

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 157KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b3588eea084e790e2d5c164b2c8a81e8

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

user32

psapi

ws2_32

gdi32

ntdll

winscard

kernel32

shell32

ole32

shlwapi

wininet

crypt32

netapi32

iphlpapi

winmm

userenv

oleaut32

Exports

Exports

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 1.2MB - Virtual size: 1.2MB

.rodata Size: 3KB - Virtual size: 2KB

.reloc Size: 157KB - Virtual size: 157KB

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 1.2MB - Virtual size: 1.2MB

.rodata
Size: 3KB - Virtual size: 2KB

.reloc
Size: 157KB - Virtual size: 157KB