07f4d429c3ae0e537fe3ddb3165177dc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

07f4d429c3ae0e537fe3ddb3165177dc_JaffaCakes118
Size

524KB
MD5

07f4d429c3ae0e537fe3ddb3165177dc
SHA1

489fd724c0381324bd2d403c30b1ca1964c15532
SHA256

9ae210d3c5100dd1e9091e84492ec5455a1441d4fc4e7430cfffedf90673df9a
SHA512

e73d095b920c96a09ab2703b0b20857ffc0f7f238df3fbab37e2ac35226d5eb9312cd747f648f04239e2a909c69b545c3172c7dfe36adcb7a13e3999fbad6e57
SSDEEP

12288:pOwlaQ981UAvjH89f/SdKzVMVnTx3/XyKz:3ljgUALYnS4zGVTh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
07f4d429c3ae0e537fe3ddb3165177dc_JaffaCakes118

Files

07f4d429c3ae0e537fe3ddb3165177dc_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

959d2a9b84e5dc1f77b30c2f6f104af4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\.Depot\Current\Client\AOLMonitor\Release\mca.pdb

Imports

kernel32

VirtualFree
Thread32Next
Thread32First
CreateToolhelp32Snapshot
GetProcAddress
HeapFree
HeapAlloc
GetProcessHeap
SetLastError
OpenThread
FileTimeToLocalFileTime
lstrcmpA
LocalAlloc
CreateThread
GetCurrentProcessId
ResetEvent
CreateEventW
SetEvent
WriteFile
CreateFileW
DeleteFileW
ReadFile
GetFileSize
GetTempFileNameW
CreateMutexA
lstrcpynA
lstrlenA
ProcessIdToSessionId
GetTickCount
GlobalUnlock
ReleaseMutex
GlobalLock
GlobalSize
GetTempPathW
GetSystemTime
CreateSemaphoreW
CreateDirectoryW
GetSystemTimeAsFileTime
ReleaseSemaphore
Sleep
UnmapViewOfFile
MapViewOfFile
GetTimeZoneInformation
SetFilePointer
GlobalAlloc
GlobalFree
GlobalReAlloc
CreateMutexW
CreateFileA
CreateFileMappingW
IsBadCodePtr
GetFullPathNameA
UnlockFile
LockFileEx
LockFile
GetTempPathA
GetFileAttributesW
DeleteFileA
GetFileAttributesA
AreFileApisANSI
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LoadLibraryA
VirtualAlloc
VirtualProtect
IsBadReadPtr
InterlockedExchangeAdd
WaitForSingleObject
GetCurrentProcess
DuplicateHandle
CloseHandle
TerminateThread
GetCurrentThread
GetThreadPriority
SetThreadPriority
FreeLibraryAndExitThread
LoadLibraryW
GetComputerNameW
LocalFree
GetCurrentThreadId
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WideCharToMultiByte
DisableThreadLibraryCalls
InterlockedIncrement
InterlockedExchange
InitializeCriticalSection
RaiseException
GetModuleFileNameW
InterlockedDecrement
FindFirstFileW
FindNextFileW
FindClose
GetLastError
lstrcmpiW
lstrlenW
lstrcatW
lstrcpynW
lstrcpyW
LocalFileTimeToFileTime
FileTimeToSystemTime
GetACP
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
FindResourceExW
GetStringTypeW
GetStringTypeA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
GetStdHandle
HeapCreate
ExitProcess
GetModuleHandleA
GetCPInfo
LCMapStringW
LCMapStringA
GetCommandLineA
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapSize
HeapReAlloc
HeapDestroy
GetVersionExA
GetThreadLocale
GetLocaleInfoA
FindResourceW
LoadResource
LockResource
SizeofResource
OpenFileMappingW
GetFullPathNameW

user32

CharLowerW
FindWindowExW
GetClassNameW
GetWindowTextW
GetWindowTextLengthW
CharNextW
SendMessageW
GetParent
RegisterWindowMessageW
UnregisterClassA
PostThreadMessageW
PeekMessageW
DispatchMessageW
KillTimer
CharLowerBuffW
GetDesktopWindow
SendMessageTimeoutW
MsgWaitForMultipleObjects
SetTimer

advapi32

SetSecurityDescriptorDacl
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
CryptDeriveKey
CryptDecrypt
CryptEncrypt
CryptDestroyKey
ConvertStringSidToSidW
SetNamedSecurityInfoW
ImpersonateLoggedOnUser
OpenThreadToken
RevertToSelf
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegGetKeySecurity
RegOpenKeyW
RegSetKeySecurity
RegQueryValueExW
LookupAccountNameW
ConvertSidToStringSidW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegDeleteKeyW

shell32

SHGetFolderPathW

ole32

CoUninitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromCLSID
GetHGlobalFromStream
CreateStreamOnHGlobal
CoInitializeEx

oleaut32

VarBstrCat
VariantInit
VariantClear
VariantChangeType
SysAllocStringLen
SysAllocStringByteLen
SysStringByteLen
SysFreeString
SafeArrayDestroy
SafeArrayUnaccessData
SysStringLen
SysAllocString
SafeArrayAccessData
SafeArrayCreateVector
VarUI4FromStr
VarBstrCmp
SystemTimeToVariantTime
SafeArrayPutElement
SafeArrayGetElement
SafeArrayCreate

shlwapi

PathFileExistsW
SHCreateStreamOnFileW
PathStripPathW
PathRemoveFileSpecW
PathAppendW

wtsapi32

WTSCloseServer
WTSOpenServerW
WTSQuerySessionInformationW
WTSFreeMemory

netapi32

NetWkstaUserEnum
NetApiBufferFree

crypt32

CryptMsgGetParam
CertFreeCertificateContext
CryptQueryObject
CryptDecodeObject

oleacc

ObjectFromLresult
AccessibleObjectFromWindow

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 380KB - Virtual size: 377KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARSTA
Size: 4KB - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

959d2a9b84e5dc1f77b30c2f6f104af4

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

wtsapi32

netapi32

crypt32

oleacc

Exports

Exports

Sections

.text Size: 380KB - Virtual size: 377KB

.rdata Size: 68KB - Virtual size: 66KB

.data Size: 12KB - Virtual size: 19KB

.SHARSTA Size: 4KB - Virtual size: 52B

.rsrc Size: 28KB - Virtual size: 26KB

.reloc Size: 28KB - Virtual size: 25KB

.text
Size: 380KB - Virtual size: 377KB

.rdata
Size: 68KB - Virtual size: 66KB

.data
Size: 12KB - Virtual size: 19KB

.SHARSTA
Size: 4KB - Virtual size: 52B

.rsrc
Size: 28KB - Virtual size: 26KB

.reloc
Size: 28KB - Virtual size: 25KB