0e96c521e72b7f40b8bb57320c3b2989_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

0e96c521e72b7f40b8bb57320c3b2989_JaffaCakes118
Size

338KB
MD5

0e96c521e72b7f40b8bb57320c3b2989
SHA1

90ef8d513ff63e6a63502e6a78b838a3a305b1da
SHA256

2ad8aa27d0952a345b815b70616455ff6ede6157a6854d28f9ee37b7a5ecf82a
SHA512

e7753dca30645cd9fd76fd5c879107a6f17279220703b9f596f9ab81d552bb60ac0c8a4eebf845ed13346254b13c2ed64ebb051b6e3a9a3bc151d7bcfb620972
SSDEEP

6144:GrfcHU+c3a/N0jQ5ExbvysSd9fjaFHwmswzLL:Grf5a/NYGExbard9fjaFHwm1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e96c521e72b7f40b8bb57320c3b2989_JaffaCakes118

Files

0e96c521e72b7f40b8bb57320c3b2989_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

42cd29d7319c74f99b156cba436678f7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

HttpQueryInfoA
InternetCrackUrlA
InternetQueryOptionA
InternetCloseHandle
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetReadFile
InternetGetConnectedState
HttpAddRequestHeadersA

shlwapi

StrToIntA
StrNCatA
StrRChrA
PathFileExistsA
wvnsprintfA
StrStrA
wnsprintfA
StrStrIA
StrCmpNIA

rpcrt4

UuidCreate
UuidToStringA

comctl32

InitCommonControlsEx

kernel32

GetProcAddress
GetModuleHandleA
lstrlenA
WinExec
IsDBCSLeadByte
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
OpenProcess
CloseHandle
GetCurrentProcess
LocalFree
HeapFree
lstrcmpA
ExpandEnvironmentStringsA
GetModuleHandleW
SetThreadLocale
GetThreadLocale
LockResource
FindResourceExA
WriteFile
CreateFileA
TerminateThread
GetTickCount
TlsSetValue
TlsGetValue
ReleaseMutex
SleepEx
lstrcpyA
WaitForSingleObject
CreateMutexA
Sleep
CreateThread
GetVersionExA
GetVersion
HeapReAlloc
ResetEvent
CreateEventA
SetEvent
OpenEventA
FlushInstructionCache
VirtualAlloc
InterlockedIncrement
LoadLibraryA
VirtualFree
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
Process32Next
Process32First
CreateToolhelp32Snapshot
GlobalFree
GlobalAlloc
GetTempPathA
lstrlenW
GetCurrentProcessId
GetExitCodeProcess
CreateProcessA
DeleteFileA
ExitProcess
SetLastError
GetCPInfo
LCMapStringW
LCMapStringA
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
VirtualQuery
GetSystemInfo
RtlUnwind
HeapSize
HeapDestroy
GetLastError
lstrcpynA
DeleteCriticalSection
InitializeCriticalSection
RaiseException
WideCharToMultiByte
MultiByteToWideChar
GetACP
GetOEMCP
IsValidCodePage
HeapCreate
GetStdHandle
GetStringTypeA
GetStringTypeW
SetHandleCount
GetEnvironmentStringsW
QueryPerformanceCounter
GetLocaleInfoA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
SetStdHandle
GetModuleFileNameA
TlsAlloc
TlsFree
lstrcmpiA
GetProcessHeap
HeapAlloc
GetPrivateProfileStringA
InterlockedDecrement
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
VirtualProtect
FreeEnvironmentStringsW

user32

DestroyWindow
RegisterClassExA
DefWindowProcA
RedrawWindow
SetActiveWindow
DrawAnimatedRects
GetWindowLongA
SetWindowLongA
CreateWindowExA
SetParent
FindWindowA
EnumChildWindows
SystemParametersInfoA
DrawMenuBar
SetForegroundWindow
TrackPopupMenu
PostMessageA
GetMenuItemID
RegisterWindowMessageA
GetSubMenu
DestroyMenu
SetMenuDefaultItem
IsWindow
LoadStringA
LoadIconA
LoadImageA
DestroyIcon
SetTimer
KillTimer
GetWindowDC
ReleaseDC
CharNextW
GetShellWindow
GetWindowThreadProcessId
GetUserObjectSecurity
GetClientRect
GetWindowRect
GetCursorPos
SetCursorPos
mouse_event
CharNextA
MessageBoxA
SendMessageA
SetWindowPos
DispatchMessageA
TranslateMessage
GetMessageA
GetActiveWindow
LoadCursorA
GetSysColorBrush
UpdateWindow
ShowWindow
LoadMenuA
GetClassNameA

gdi32

SelectObject
BitBlt
DeleteObject
DeleteDC
CreateDIBSection
CreateCompatibleDC
GetPixel

advapi32

CreateProcessAsUserA
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetNamedSecurityInfoA
RegOpenKeyExA
RegCreateKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyA
RegQueryValueExA
RegCloseKey
SetTokenInformation
GetLengthSid
ConvertStringSidToSidW
DuplicateTokenEx
RegQueryInfoKeyA
RegEnumKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
IsValidSid
GetSecurityDescriptorOwner
OpenProcessToken
ConvertSidToStringSidA
RegOpenKeyA
CloseServiceHandle
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegSetValueExA

shell32

SHAppBarMessage
SHGetFolderPathA
Shell_NotifyIconA

ole32

CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize
StringFromGUID2
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
OleSetContainedObject
OleCreate
OleUninitialize
OleInitialize
CoTaskMemAlloc

oleaut32

SysAllocStringLen
VariantInit
VariantClear
VarUI4FromStr
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysAllocString
UnRegisterTypeLi
RegisterTypeLi
SafeArrayDestroy
SafeArrayAccessData
SafeArrayCreate
SysFreeString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetLocid
GetTicket
RegisterTrayIcon
RunTrayIcon
ShowDoneMessage
ShowWelcomePage
UnregisterTrayIcon

Sections

.text
Size: 221KB - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

42cd29d7319c74f99b156cba436678f7

Headers

File Characteristics

Imports

wininet

shlwapi

rpcrt4

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 221KB - Virtual size: 221KB

.rdata Size: 73KB - Virtual size: 73KB

.data Size: 15KB - Virtual size: 25KB

.rsrc Size: 10KB - Virtual size: 10KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 221KB - Virtual size: 221KB

.rdata
Size: 73KB - Virtual size: 73KB

.data
Size: 15KB - Virtual size: 25KB

.rsrc
Size: 10KB - Virtual size: 10KB

.reloc
Size: 16KB - Virtual size: 15KB