06cae746d30e8d119e478fae55df766b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

06cae746d30e8d119e478fae55df766b_JaffaCakes118
Size

175KB
MD5

06cae746d30e8d119e478fae55df766b
SHA1

a7a0bf36f3393323d00f13bce2d422ac483fb8bd
SHA256

99b0af209c05c5a7969de4aadedd46cd2e9b28c294fba63ad9cceb5956f306c7
SHA512

33d7daaeb4ee071e06070c2e8a5c49c0774fd59392c2e576512ebfca443f849ca1e8af219ea723425529e98e0436f964a45f2d4a6d08b8e4c0bd9e2fa0deda7f
SSDEEP

3072:p9csSiHqtgqRLgDaNuSLEIH0pLcEYGZjZ7gXJPvXKCQTgv4YxQTVQm:4sSqILgDrIUgdfKZTgv4b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06cae746d30e8d119e478fae55df766b_JaffaCakes118

Files

06cae746d30e8d119e478fae55df766b_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

0ee6bbd212d4eac4197ba29641d469f9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

SHSetValueA
SHDeleteKeyA
PathAppendA
PathFileExistsA
SHDeleteValueA
PathFindFileNameA
SHGetValueA
PathStripToRootA
StrStrIA
PathIsUNCA
PathFindExtensionA
PathRemoveExtensionA
PathRemoveFileSpecA
PathRemoveBackslashA
PathRemoveBlanksA

kernel32

GetModuleHandleW
LoadLibraryW
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
UnmapViewOfFile
LeaveCriticalSection
EnterCriticalSection
ReadFile
FreeLibrary
CreateFileA
GetShortPathNameA
GetLongPathNameA
GetSystemDirectoryA
GetWindowsDirectoryA
lstrcpynA
GetVersionExA
GetTickCount
OutputDebugStringA
FindNextFileA
FindFirstFileA
WaitForSingleObject
TerminateThread
GetModuleFileNameA
SetLastError
WideCharToMultiByte
VirtualQuery
lstrcmpiA
VirtualProtect
WriteProcessMemory
GetCurrentProcessId
CreateToolhelp32Snapshot
Module32First
Module32Next
CloseHandle
GetModuleHandleA
GetCurrentProcess
FlushInstructionCache
GetSystemInfo
GetFileAttributesW
LoadLibraryA
SetThreadPriority
Sleep
CreateThread
OpenMutexA
CreateMutexA
GetLastError
lstrcmpA
lstrlenW
lstrlenA
FindClose
MultiByteToWideChar
LocalFree
GetProcAddress
GetVersion
GlobalSize
DeleteFileA
lstrcatA
lstrcpyA
IsBadStringPtrA
GlobalLock
GetFileSize
GetPrivateProfileStringA
IsBadStringPtrW
TlsGetValue
TlsSetValue
GetCurrentThreadId
TlsFree
TlsAlloc
WritePrivateProfileSectionA
DeviceIoControl
GetPrivateProfileIntA
WritePrivateProfileStringA
MoveFileExA
WriteFile
WritePrivateProfileStructA
GetTempPathA
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
IsDebuggerPresent
GetACP
CopyFileA
CreateProcessA
GetPrivateProfileStructA

user32

GetPropA
RegisterWindowMessageA
GetClassNameA
SendMessageA
SetWindowTextA
IsWindow
GetParent
EnumWindows
MessageBoxA
SetWindowsHookExA
InvalidateRect
ReleaseDC
DrawTextA
GetWindowTextA
FillRect
GetSysColor
GetDC
GetFocus
GetKeyState
SetWindowLongW
GetWindowLongW
GetComboBoxInfo
DrawFocusRect
UnhookWindowsHookEx
CallNextHookEx
GetWindowThreadProcessId
IsWindowVisible
DialogBoxParamA
GetWindow
GetWindowRect
SystemParametersInfoA
GetClientRect
MapWindowPoints
SetWindowPos
GetDlgItemTextA
EndDialog
GetWindowTextLengthA
GetDlgItem
EnableWindow
LoadStringA
EnumChildWindows
SendMessageTimeoutA
WindowFromPoint
DefWindowProcA
CallWindowProcA
FindWindowExA
GetWindowLongA
SetPropA
SetWindowLongA
RemovePropA

advapi32

RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueA
RegCreateKeyExA
RegSetValueA
RegCreateKeyA
RegSetValueExA
RegEnumKeyExA
RegCloseKey
CloseServiceHandle
OpenSCManagerA
DeleteService
OpenServiceA
ControlService

ole32

RevokeDragDrop
RegisterDragDrop
CoCreateGuid
StringFromCLSID
CoTaskMemFree
CoInitialize
CoUninitialize
ReleaseStgMedium

oleaut32

VariantClear
SysAllocString
SysFreeString

imagehlp

ImageDirectoryEntryToData

msvcrt

fgets
fopen
_mbclen
_ismbcdigit
malloc
atoi
_vsnprintf
_mbsnbcpy
_CxxThrowException
fwrite
rand
srand
time
fread
fseek
ftell
fputs
??1type_info@@UAE@XZ
rewind
wcslen
strrchr
tmpnam
_wcsicmp
_tempnam
atol
_ltoa
_mbstok
__dllonexit
_onexit
_initterm
_adjust_fdiv
fclose
bsearch
_mbsrchr
free
_snprintf
realloc
_mbslwr
_mbsstr
_mbschr
_mbsnbicmp
_mbscmp
_except_handler3
sprintf
_purecall
wcscpy
_mbsicmp
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
_stricmp
_strlwr
_itoa
strstr

urlmon

IsValidURL
URLDownloadToFileA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

ws2_32

send
gethostbyname
setsockopt
socket
inet_addr
WSAStartup
WSACleanup
closesocket
recv
inet_ntoa
htons
connect
WSAGetLastError

gdi32

SetBkMode
GetStockObject
DeleteObject
CreateSolidBrush
SetTextColor
GetTextExtentPointA
SetPixel
LineTo
MoveToEx
CreatePen
SetBkColor
SelectObject

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHGetDesktopFolder
ShellExecuteA
SHGetSpecialFolderPathA

wininet

InternetCrackUrlA
DeleteUrlCacheEntry

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Register
Uninstall

Sections

.text
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0ee6bbd212d4eac4197ba29641d469f9

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

advapi32

ole32

oleaut32

imagehlp

msvcrt

urlmon

version

ws2_32

gdi32

shell32

wininet

Exports

Exports

Sections

.text Size: 94KB - Virtual size: 94KB

.rdata Size: 19KB - Virtual size: 18KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 94KB - Virtual size: 94KB

.rdata
Size: 19KB - Virtual size: 18KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 11KB - Virtual size: 10KB