0faca86ab04ce35eedb1ef294b3cc836_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0faca86ab04ce35eedb1ef294b3cc836_JaffaCakes118
Size

387KB
MD5

0faca86ab04ce35eedb1ef294b3cc836
SHA1

c2810eece6506aa7dcaaf66f215c391e1e4ff70d
SHA256

c9fe690a4517ce78b33355af5b51dfdeac67fc56dc9398367d77cc1c293bd87d
SHA512

4596a7ae88d1ab5be23125730f8c330d473f127fbc3ba26f9a12a51adfe842fe7f0e2972f37fdf43a08c9b58d5ad1560eec2162ff29745939462cb10b451f7fa
SSDEEP

6144:nDjoE8bP0NpBw6FC9ExKucH+fOkEXRTrC6kpitmdD019Y:nXoqTCjLucH+fOkEXRTrC6/mdD0o

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0faca86ab04ce35eedb1ef294b3cc836_JaffaCakes118

Files

0faca86ab04ce35eedb1ef294b3cc836_JaffaCakes118
.dll windows:4 windows x86 arch:x86

e99bd711f8e9a2c70ff67ef84568ff10

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

SHDeleteKeyA

msvcrt

??3@YAXPAX@Z
memcpy
memmove
ceil
_ftol
strlen
strstr
__CxxFrameHandler
memset
_strnset
_strrev
_strnicmp
_strupr
_strcmpi
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
calloc
_beginthreadex
wcstombs
realloc
strncat
wcscpy
_errno
strncmp
_snprintf
atoi
strncpy
strrchr
strcat
_except_handler3
free
strcmp
strcpy
malloc
strchr
memcmp
??2@YAPAXI@Z

kernel32

SetEvent
InterlockedExchange
CancelIo
lstrlenA
GetPrivateProfileSectionNamesA
lstrcatA
GetWindowsDirectoryA
MultiByteToWideChar
WideCharToMultiByte
lstrcmpA
GetPrivateProfileStringA
GetVersionExA
DeleteFileA
GetLastError
CreateDirectoryA
GetDriveTypeA
FindClose
DeleteCriticalSection
FindNextFileA
LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
GetFileSize
CreateFileA
ReadFile
SetFilePointer
WriteFile
Sleep
GetModuleFileNameA
SetLastError
GetSystemDirectoryA
ExitProcess
GetCurrentProcess
GetVersion
DeviceIoControl
CreateThread
lstrcpyA
WriteProcessMemory
VirtualAllocEx
OpenProcess
GetLocalTime
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateThread
CreateEventA
MoveFileExA
MoveFileA
GetTickCount
WaitForSingleObject
GlobalUnlock
GlobalLock
GlobalSize
GlobalFree
GlobalAlloc
CreateProcessA
CreatePipe
TerminateProcess
PeekNamedPipe
OutputDebugStringA
GlobalMemoryStatusEx
GetSystemInfo
OpenEventA
SetErrorMode
SetUnhandledExceptionFilter
FreeConsole
LocalSize
lstrcmpiA
GetCurrentThreadId
InitializeCriticalSection
CloseHandle
LoadLibraryA
GetProcAddress
FreeLibrary
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
CreateRemoteThread
VirtualFree
LocalFree
RaiseException

user32

OpenDesktopA
PostMessageA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
IsWindowVisible
GetWindowThreadProcessId
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation
GetCursorInfo
GetCursorPos
ReleaseDC
GetDesktopWindow
GetDC
SetRect
GetSystemMetrics
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
wsprintfA
ExitWindowsEx
MessageBoxA
GetWindowTextA
GetForegroundWindow
GetAsyncKeyState
GetKeyState
EnumWindows
LoadCursorA
DestroyCursor
SystemParametersInfoA
keybd_event
BlockInput
MapVirtualKeyA
SetCapture
WindowFromPoint
SetCursorPos
mouse_event
CloseClipboard

gdi32

GetDIBits
BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC
CreateDIBSection
SelectObject
CreateCompatibleBitmap

advapi32

RegOpenKeyA
RegQueryValueExA
RegSetValueExA
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
RegOpenKeyExA
RegCloseKey
RegQueryValueA
LsaFreeMemory
LsaOpenPolicy
LsaRetrievePrivateData
LsaClose
LookupAccountNameA
IsValidSid
GetTokenInformation
LookupAccountSidA
SetServiceStatus
RegisterServiceCtrlHandlerA
RegDeleteValueA
RegDeleteKeyA
RegEnumValueA
RegEnumKeyExA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

shell32

SHGetFileInfoA
SHGetSpecialFolderPathA

ws2_32

getpeername
getsockname
bind
WSACleanup
__WSAFDIsSet
ioctlsocket
send
inet_ntoa
recvfrom
gethostname
recv
select
ntohs
closesocket
WSAStartup
connect
htons
socket
gethostbyname
inet_addr

msvcp60

?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB

netapi32

NetUserAdd
NetLocalGroupAddMembers

wininet

InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetReadFile

psapi

GetModuleFileNameExA
EnumProcessModules

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationA

Exports

Exports

Eternal
Go
Heart
On
ServiceMain

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 285KB - Virtual size: 284KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e99bd711f8e9a2c70ff67ef84568ff10

Headers

File Characteristics

Imports

shlwapi

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ws2_32

msvcp60

netapi32

wininet

psapi

wtsapi32

Exports

Exports

Sections

.text Size: 96KB - Virtual size: 95KB

.rsrc Size: 285KB - Virtual size: 284KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 96KB - Virtual size: 95KB

.rsrc
Size: 285KB - Virtual size: 284KB

.reloc
Size: 5KB - Virtual size: 5KB