16d6df86d15a7a0dee7649049646d67f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

16d6df86d15a7a0dee7649049646d67f_JaffaCakes118
Size

182KB
MD5

16d6df86d15a7a0dee7649049646d67f
SHA1

cfaea5db00cfd6482dddc69d75ecc2f0229619e1
SHA256

26bc8cbdcbeb4725f82d1e82255ae82656f7143fa603ddd5dbd584b0d3079769
SHA512

bd55404657592855ab8ff194a2b33f8310801348e5ae95761bba76d0f9c25c1be668e31acc5c3b6911b5da197d90494ad3906ae103d876304ef7ee7b6e7d3d8a
SSDEEP

3072:zgW62090biknDq0qIiN0m6DHDLkULCUh8zNIAC2A7bByHo:X6IbiqWvIfHTLCG8FnAf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16d6df86d15a7a0dee7649049646d67f_JaffaCakes118

Files

16d6df86d15a7a0dee7649049646d67f_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

eab21d45b19e01c9860f8a8e0be821d3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

xmlprov.pdb

Imports

msvcrt

memmove
_wtoi
_vsnwprintf
??0exception@@QAE@ABV0@@Z
_CxxThrowException
wcsrchr
_wfullpath
wcstoul
_wcsdup
wcslen
free
realloc
__CxxFrameHandler
_purecall
_vsnprintf
??2@YAPAXI@Z
malloc
_initterm
_adjust_fdiv
?terminate@@YAXXZ
_except_handler3
??1type_info@@UAE@XZ
??3@YAXPAX@Z

msvcp60

??0bad_alloc@std@@QAE@PBD@Z
??1bad_alloc@std@@UAE@XZ
??0bad_alloc@std@@QAE@ABV01@@Z

atl

ord23
ord20
ord17
ord21
ord16
ord32
ord30
ord18
ord22

advapi32

UnlockServiceDatabase
RegisterServiceCtrlHandlerExW
SetServiceStatus
OpenSCManagerW
OpenServiceW
CloseServiceHandle
LockServiceDatabase
ChangeServiceConfigW
QueryServiceConfigW
RegEnumKeyExW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW

kernel32

GetDiskFreeSpaceExW
LocalFree
LocalAlloc
GetFileAttributesExW
HeapFree
GetProcessHeap
CreateTimerQueueTimer
RemoveDirectoryW
FileTimeToSystemTime
EnumUILanguagesW
InitializeCriticalSection
GetCurrentThreadId
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DeleteFileW
FormatMessageW
DeleteTimerQueueTimer
InterlockedExchange
CopyFileW
Sleep
WaitForSingleObject
QueueUserWorkItem
WideCharToMultiByte
HeapAlloc
DisableThreadLibraryCalls
MultiByteToWideChar
lstrlenW
GetStringTypeExW
GetThreadLocale
lstrcmpW
InterlockedDecrement
InterlockedIncrement
EnterCriticalSection
LeaveCriticalSection
lstrlenA
GetLastError
CreateEventW
CloseHandle
SetEvent
InterlockedCompareExchange
DeleteCriticalSection
GetSystemTimeAsFileTime
lstrcmpiW
DebugBreak
OutputDebugStringW
FindNextFileW
FindClose
SetFileAttributesW
CreateDirectoryW
lstrcpyW
InitializeCriticalSectionAndSpinCount
SetLastError
FindFirstFileW
MoveFileExW

ole32

CoTaskMemFree
CLSIDFromString
CoTaskMemAlloc
CoCreateInstance
CoInitializeEx
StringFromCLSID
IIDFromString
CoUninitialize
CoSwitchCallContext

oleaut32

SysFreeString
SysAllocString
VariantClear
VariantChangeType
SysAllocStringLen
SysStringLen
VariantInit

rtutils

TraceRegisterExW
TracePrintfA
TraceDeregisterW

shell32

SHGetFolderPathW

shlwapi

PathCanonicalizeW
PathIsRelativeW
PathRemoveExtensionW
PathFileExistsW
PathStripPathW
PathCreateFromUrlW
UrlIsW

user32

LoadStringW
CharNextW
CharUpperW
CharLowerW
wvsprintfW

winhttp

WinHttpCrackUrl

ntdll

RtlReleaseResource
RtlAcquireResourceExclusive
RtlAcquireResourceShared
RtlDeleteResource
RtlInitializeResource

Exports

Exports

DllRegisterServer
DllUnregisterServer
ServiceMain

Sections

.text
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eab21d45b19e01c9860f8a8e0be821d3

Headers

File Characteristics

PDB Paths

Imports

msvcrt

msvcp60

atl

advapi32

kernel32

ole32

oleaut32

rtutils

shell32

shlwapi

user32

winhttp

ntdll

Exports

Exports

Sections

.text Size: 115KB - Virtual size: 114KB

.data Size: 56KB - Virtual size: 56KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 115KB - Virtual size: 114KB

.data
Size: 56KB - Virtual size: 56KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 7KB