0e4bf62cb1392b13b513f76755c57d96_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0e4bf62cb1392b13b513f76755c57d96_JaffaCakes118
Size

135KB
MD5

0e4bf62cb1392b13b513f76755c57d96
SHA1

87ffbcc0edfb6c4f11f1c6772ad14fc080cb685a
SHA256

4b690a09e9c40496302edbbbcef2f9236360c6f19cab833420bc0919e75b89e6
SHA512

bd70d39903fd70e813c051236c8341842589c7ea9f0ee4f1223c3b28edc08a1fbce0ed6fbff7a68b20b29ca06ebeb51f293da15449d91c3195fed4ee51961ce5
SSDEEP

3072:xC+VIWKyo76zZEID7F07QAoacC5nxajtL3fFe5uaL9q/NufWS:xC+VISukD7y79vcvjtjfF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e4bf62cb1392b13b513f76755c57d96_JaffaCakes118

Files

0e4bf62cb1392b13b513f76755c57d96_JaffaCakes118
.dll windows:4 windows x86 arch:x86

d345212ab2b910801bc405fd8374737d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
LookupPrivilegeValueW
CreateWellKnownSid
IsValidSid
CopySid
GetLengthSid
GetTokenInformation
EqualSid
AddAce
GetAce
AddAccessAllowedAce
InitializeAcl
GetAclInformation
OpenProcessToken
SetTokenInformation
GetSecurityDescriptorDacl
GetKernelObjectSecurity
CreateProcessAsUserW
CreateRestrictedToken
RegDeleteKeyW
RegEnumKeyW
RegOpenKeyW
RegQueryValueW
RegCreateKeyExW
RegSetValueExW

kernel32

FindClose
FindFirstFileW
GetVolumeInformationW
GetFullPathNameW
SetErrorMode
FileTimeToLocalFileTime
GetFileAttributesW
GetFileSizeEx
GetFileTime
HeapFree
HeapAlloc
GetProcessHeap
RtlUnwind
HeapValidate
IsBadReadPtr
RaiseException
WriteFile
ExitProcess
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetSystemTimeAsFileTime
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
DuplicateHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
GetModuleFileNameA
UnhandledExceptionFilter
TerminateProcess
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
LCMapStringA
LCMapStringW
HeapReAlloc
GetTimeZoneInformation
GetLocaleInfoA
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateFileA
SetEnvironmentVariableA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
WritePrivateProfileStringW
lstrlenA
GetModuleHandleA
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
FormatMessageW
LocalFree
MulDiv
GlobalFlags
GetTickCount
GlobalFree
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
InterlockedDecrement
GlobalAlloc
InterlockedIncrement
FileTimeToSystemTime
GetThreadLocale
FreeResource
GetCurrentThreadId
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LoadLibraryA
lstrcmpW
MultiByteToWideChar
GetVersionExA
lstrlenW
GlobalLock
GlobalUnlock
GetCurrentProcessId
GlobalGetAtomNameW
GlobalAddAtomW
SetLastError
WideCharToMultiByte
FindResourceW
LoadResource
LockResource
SizeofResource
GetStartupInfoW
GetModuleFileNameW
GetCurrentProcess
GetCommandLineW
IsDebuggerPresent
FreeLibrary
GetProcAddress
LoadLibraryW
GetVersionExW
GetModuleHandleW
CreateFileW
GetFileSize
ReadFile
CloseHandle
SetFilePointer
GetStdHandle
GetLastError
SetEnvironmentVariableW
RemoveDirectoryW

gdi32

GetTextColor
GetBkColor
GetMapMode
CreateSolidBrush
GetStockObject
CreatePatternBrush
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutW
RectVisible
PtVisible
GetPixel
GetWindowExtEx
GetViewportExtEx
SetMapMode
SetBkMode
RestoreDC
SaveDC
GetDeviceCaps
DeleteObject
GetRgnBox
CreateRectRgnIndirect
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
GetTextExtentPoint32W
ExtTextOutW
BitBlt
CreateFontIndirectW
GetObjectW
CreateCompatibleDC
CreateCompatibleBitmap
CreateRoundRectRgn
CreateRectRgn

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

shlwapi

PathStripToRootW
PathFindFileNameW
PathFindExtensionW
PathRemoveFileSpecW
PathCombineW
PathIsUNCW

shell32

SHGetFolderPathW
DragQueryFileW
DragFinish
CommandLineToArgvW
SHFileOperationW

ole32

OleInitialize
OleUninitialize
CLSIDFromProgID
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromString
CoUninitialize
CoInitialize
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
CoRegisterMessageFilter
CoFreeUnusedLibraries

comdlg32

GetFileTitleW

oleaut32

SysAllocStringLen
VariantChangeType
VariantInit
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
SysFreeString
SysAllocString
OleCreateFontIndirect
VariantClear

oledlg

OleUIBusyW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

Sections

.text
Size: 90KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 192KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d345212ab2b910801bc405fd8374737d

Headers

File Characteristics

Imports

advapi32

kernel32

gdi32

winspool.drv

shlwapi

shell32

ole32

comdlg32

oleaut32

oledlg

version

Sections

.text Size: 90KB - Virtual size: 160KB

.bss Size: - Virtual size: 192KB

.pdata Size: 4KB - Virtual size: 4KB

.data Size: 4KB - Virtual size: 4KB

.rdata Size: 4KB - Virtual size: 4KB

.tls Size: 4KB - Virtual size: 4KB

.idata Size: 7KB - Virtual size: 6KB

.rsrc Size: 16KB - Virtual size: 16KB

.reloc Size: 4KB - Virtual size: 212B

.text
Size: 90KB - Virtual size: 160KB

.bss
Size: - Virtual size: 192KB

.pdata
Size: 4KB - Virtual size: 4KB

.data
Size: 4KB - Virtual size: 4KB

.rdata
Size: 4KB - Virtual size: 4KB

.tls
Size: 4KB - Virtual size: 4KB

.idata
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 4KB - Virtual size: 212B