159a0c1a9482528347381738bab28549_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

159a0c1a9482528347381738bab28549_JaffaCakes118
Size

196KB
MD5

159a0c1a9482528347381738bab28549
SHA1

b922df00e6d17f37f61109a761df620d03fbeb02
SHA256

46fd5a918b5a0efe82001ea136464b35beb22dc7296022b2285e8dcc60c43230
SHA512

f136d15d0948196eddbd5774b18b6dc256aff2c0d599f079dc0535bb65ba0154e2429e511dae97ea4f0e349cb766ad0cdf0f084cce3f83ad29b65afa21ee9c47
SSDEEP

3072:gMftopTx9H4nBh77fd1ohGJDxNXIG9U4x6XHrOtle/Z:gV9YBTSI+AYGCZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
159a0c1a9482528347381738bab28549_JaffaCakes118

Files

159a0c1a9482528347381738bab28549_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

2f6b67c20a8b33111fcaa497f1b72a81

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\home\dev\x\Release\webperform.pdb

Imports

kernel32

FindResourceExW
Sleep
GetTickCount
InitializeCriticalSection
DeleteCriticalSection
lstrcmpiW
GetModuleHandleW
InterlockedIncrement
InterlockedDecrement
GlobalFree
GlobalHandle
FreeLibrary
LoadLibraryExW
SetThreadLocale
GetThreadLocale
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
GetStringTypeW
SizeofResource
lstrlenA
LCMapStringA
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
WriteFile
HeapCreate
ExitProcess
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetSystemTimeAsFileTime
CreateThread
ResumeThread
CloseHandle
ExitThread
WideCharToMultiByte
VirtualQuery
GetSystemInfo
GetModuleHandleA
VirtualProtect
RtlUnwind
IsDebuggerPresent
GetCurrentThreadId
RaiseException
MulDiv
lstrcmpW
GetCurrentProcess
FlushInstructionCache
GetModuleFileNameW
FindResourceW
LoadResource
GetStringTypeA
LockResource
MultiByteToWideChar
GlobalAlloc
GlobalLock
GlobalUnlock
lstrlenW
SetLastError
GetLastError
EnterCriticalSection
LeaveCriticalSection
LCMapStringW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcAddress
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetVersionExA
GetLocaleInfoA
GetACP
InterlockedExchange

user32

wvsprintfW
SetWindowLongW
GetWindowLongW
SetWindowTextW
GetWindowTextLengthW
EnableWindow
SetFocus
IsChild
GetDlgItem
IsDialogMessageW
SetWindowPos
MapWindowPoints
GetClientRect
SendMessageW
DestroyWindow
CharLowerBuffW
CreateDialogIndirectParamW
ShowWindow
CreateAcceleratorTableW
IsWindow
DestroyAcceleratorTable
GetDesktopWindow
BeginPaint
EndPaint
CallWindowProcW
FillRect
ReleaseCapture
GetClassNameW
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
MoveWindow
CharNextW
GetSysColor
SetWindowContextHelpId
SendDlgItemMessageW
CreateWindowExW
MapDialogRect
RegisterWindowMessageW
GetClassInfoExW
LoadCursorW
RegisterClassExW
GetWindowTextW
DefWindowProcW
GetFocus
PostQuitMessage
GetParent
GetWindow
GetWindowRect
SystemParametersInfoW
UnregisterClassA

gdi32

GetObjectW
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
DeleteDC
GetStockObject

advapi32

RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteKeyW

shell32

SHGetFileInfoW

ole32

OleInitialize
OleUninitialize
StringFromGUID2
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoTaskMemAlloc
CoInitialize
CoTaskMemFree
StringFromCLSID
CoTaskMemRealloc
CreateStreamOnHGlobal

oleaut32

VariantInit
VariantClear
SysAllocStringLen
SysAllocString
DispCallFunc
LoadRegTypeLi
LoadTypeLi
SysStringByteLen
OleCreateFontIndirect
VarUI4FromStr
UnRegisterTypeLi
RegisterTypeLi
SysFreeString
SysStringLen

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 120KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2f6b67c20a8b33111fcaa497f1b72a81

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 120KB - Virtual size: 118KB

.rdata Size: 36KB - Virtual size: 32KB

.data Size: 12KB - Virtual size: 18KB

.SHARED Size: 4KB - Virtual size: 12B

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 16KB - Virtual size: 12KB

.text
Size: 120KB - Virtual size: 118KB

.rdata
Size: 36KB - Virtual size: 32KB

.data
Size: 12KB - Virtual size: 18KB

.SHARED
Size: 4KB - Virtual size: 12B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 16KB - Virtual size: 12KB