06a3ad218bd5a3d53bb0846cd372f0a8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
06a3ad218bd5a3d53bb0846cd372f0a8_JaffaCakes118
Size 192KB
Sample240620-rbed3a1elf
SHA256 7f68096c0e7aed5a847840423c7b50d6638594c0e2d5048b3b540712ef34db6f
MD5 06a3ad218bd5a3d53bb0846cd372f0a8
SHA1 d3ff9ad7ca69308a3d5cf67a78141a81c8fe2121
SHA512 0062e0f053d109ff9fe9eed7edbe96fa9cf87591c235fe9d3ef72c855868ffe5a4ed9d2192d4ce2dcde3e0e272099b3a3fe85d99befdd33a671d0782e86fcdd0
SSDEEP 3072:p9NkAs3vNMzIduJ0fUq1mp5WeT9u7dlHsNr/L:HNkAsFSlqYjWH7u
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06a3ad218bd5a3d53bb0846cd372f0a8_JaffaCakes118

File Explorer

06a3ad218bd5a3d53bb0846cd372f0a8_JaffaCakes118

.dll 192KB

06a3ad218bd5a3d53bb0846cd372f0a8_JaffaCakes118

IMPHASH 97bf0a88201cc9ee5a2406c67ee42212
SHA256 7f68096c0e7aed5a847840423c7b50d6638594c0e2d5048b3b540712ef34db6f
MD5 06a3ad218bd5a3d53bb0846cd372f0a8
SHA1 d3ff9ad7ca69308a3d5cf67a78141a81c8fe2121
SHA512 0062e0f053d109ff9fe9eed7edbe96fa9cf87591c235fe9d3ef72c855868ffe5a4ed9d2192d4ce2dcde3e0e272099b3a3fe85d99befdd33a671d0782e86fcdd0
SSDEEP 3072:p9NkAs3vNMzIduJ0fUq1mp5WeT9u7dlHsNr/L:HNkAsFSlqYjWH7u
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

95936

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetEndOfFile GetOEMCP GetACP SetFilePointer FlushFileBuffers SetStdHandle GetStringTypeW GetStringTypeA GetCPInfo IsBadCodePtr IsBadReadPtr SetUnhandledExceptionFilter WriteFile GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA GetFileType GetStdHandle SetHandleCount IsBadWritePtr VirtualAlloc VirtualFree HeapCreate ReadFile HeapSize TerminateProcess LCMapStringW LCMapStringA ExitProcess TlsGetValue SetLastError TlsFree TlsAlloc TlsSetValue GetVersion GetCommandLineA HeapReAlloc HeapAlloc RtlUnwind InterlockedExchange Sleep UnmapViewOfFile CreateFileA CreateFileMappingA MapViewOfFile WinExec IsDBCSLeadByte LoadLibraryExA FindResourceA LoadResource SizeofResource HeapDestroy InterlockedIncrement DeleteCriticalSection InitializeCriticalSection DisableThreadLibraryCalls CreateMutexA GetLastError GetShortPathNameA FreeLibrary FindFirstFileW FindNextFileW FindClose ExpandEnvironmentStringsW LocalFree lstrcatW GetModuleFileNameW LoadLibraryW lstrcmpiW lstrcpynW lstrlenW GetProcessHeap HeapFree WriteProcessMemory CreateToolhelp32Snapshot Module32First Module32Next lstrlenA lstrcmpiA GetCurrentProcessId CloseHandle OpenProcess GetModuleFileNameA lstrcatA GetSystemDefaultLangID GetPrivateProfileIntA GetPrivateProfileStringA lstrcpyW lstrcmpA lstrcpyA WideCharToMultiByte MultiByteToWideChar lstrcpynA GetModuleHandleA GetVersionExA InterlockedDecrement EnterCriticalSection LeaveCriticalSection GetCurrentProcess FlushInstructionCache GetCurrentThreadId LoadLibraryA GetProcAddress GetStartupInfoA

user32

SetWindowTextA GetCursorPos SetTimer UpdateWindow DefWindowProcA IsWindow GetWindowRect GetDlgCtrlID GetWindowTextW GetWindowTextLengthW SetWindowTextW PostMessageW SendMessageW DrawTextW FindWindowExW LoadImageW LoadIconW FindWindowW GetClassNameW SetWindowsHookExW wsprintfW CharNextA DrawIconEx GetWindowDC LoadImageA GetWindowThreadProcessId FillRect GetFocus LoadIconA DestroyIcon FindWindowExA GetSysColor SendMessageA GetWindowTextLengthA SetFocus LoadBitmapA CallWindowProcW SetWindowLongW GetClassNameA GetParent GetWindowLongW FindWindowA GetSystemMetrics GetClassInfoExA LoadCursorA wsprintfA RegisterClassExA ReleaseDC EndPaint CreateWindowExA CallWindowProcA GetWindowLongA SetWindowLongA CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA ReleaseCapture SetCapture PtInRect GetDC InflateRect BeginPaint SystemParametersInfoA ShowWindow PostMessageA MoveWindow SetWindowRgn ScreenToClient OffsetRect SetRectEmpty GetClientRect DrawFrameControl GetWindowTextA DrawTextA IsRectEmpty CopyRect KillTimer

gdi32

SetStretchBltMode StretchBlt ExtTextOutA GetStockObject GetObjectA CreateFontIndirectA DeleteObject SetBkColor SelectObject CreateCompatibleDC SetTextColor SetBkMode FrameRgn OffsetRgn CreateSolidBrush ExcludeClipRect SetWindowOrgEx GetClipBox BitBlt EqualRgn CombineRgn CreateRectRgn CreatePolygonRgn SetViewportOrgEx GetViewportOrgEx SetPixel GetTextExtentPoint32A GetTextExtentPointA GetTextExtentPoint32W GetTextExtentPointW DeleteDC CreateCompatibleBitmap

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey RegQueryInfoKeyA RegEnumValueA RegSetValueExA RegCreateKeyExA RegDeleteKeyA RegQueryValueExW RegEnumKeyExW RegQueryInfoKeyW RegOpenKeyExW RegDeleteValueA RegDeleteKeyW RegCreateKeyExW RegSetValueExW RegEnumValueW RegEnumKeyExA

shell32

SHGetDesktopFolder SHGetSpecialFolderPathW SHGetMalloc SHGetSpecialFolderLocation ShellExecuteA

ole32

CoTaskMemAlloc CoFreeUnusedLibraries CoInitialize CoCreateInstance CoUninitialize CoTaskMemFree CoTaskMemRealloc

oleaut32

RegisterTypeLi LoadTypeLi SysAllocString SysFreeString OleTranslateColor SysStringLen VarUI4FromStr LoadRegTypeLi

shlwapi

UrlApplySchemeW StrRetToBufW PathIsURLW StrCpyW StrDupW StrStrW StrStrIW StrStrA StrStrIA StrCmpW StrRStrIW PathFileExistsW PathIsDirectoryW StrCmpNIW StrDupA PathAppendA PathRemoveFileSpecA StrNCatW StrCmpIW

wininet

InternetCrackUrlW

comctl32

ImageList_AddMasked ImageList_Create ImageList_Draw ImageList_SetBkColor ImageList_GetIconSize ImageList_ReplaceIcon ImageList_Remove ImageList_Destroy

Name

.text

Size

116KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Shared

Size

4KB

Virtual Size

60B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

24KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

06a3ad218bd5a3d53bb0846cd372f0a8_JaffaCakes118

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

comctl32

generic