18b96b2d2bffff2d8ce43b80f99ee834_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

18b96b2d2bffff2d8ce43b80f99ee834_JaffaCakes118
Size

193KB
MD5

18b96b2d2bffff2d8ce43b80f99ee834
SHA1

ac4b755033099a232fc5b36f7c007ff8a17155a7
SHA256

82a503d864ec7f8a240c207af5257cb64e4bd52015f80cab3924643a4d41e00e
SHA512

571139e8e539f27a708635981c6e77da7d0d322585c6e06443da7bd3434d3cb1f274293909be23d3affb0be4b7025da88241e03971462ca5b7bf079ae13471bd
SSDEEP

3072:n73MITL/9oSmkbx3ZtffjBTnIwanLMFylo7Ay+TZ5fq43Uk2grFL:7dTpountf75Iwksylo/OZ5SUUklV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18b96b2d2bffff2d8ce43b80f99ee834_JaffaCakes118

Files

18b96b2d2bffff2d8ce43b80f99ee834_JaffaCakes118
.dll regsvr32 windows:6 windows x86 arch:x86

cef4fbca5da8f1ceb161e89d7b681856

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\DOCUME~1\bld4act\LOCALS~1\Temp\Hpolaris\optPolaris\baseline\WMPBand.pdb

Imports

msvcrt

_wtoi
towupper
wcsstr
bsearch
iswdigit
wcsncmp
??_U@YAPAXI@Z
wcschr
wcspbrk
wcsrchr
_beginthreadex
_vsnwprintf
_wcsnicmp
towlower
iswspace
_wtol
_wcsicmp
_onexit
_lock
__dllonexit
_unlock
memmove
_adjust_fdiv
_amsg_exit
_initterm
_XcptFilter
??_V@YAXPAX@Z
memcpy
realloc
malloc
memset
??2@YAPAXI@Z
free
_purecall
??3@YAXPAX@Z

uxtheme

OpenThemeData
DrawThemeParentBackground
CloseThemeData

kernel32

SetErrorMode
CreateThread
WaitForSingleObject
CreateMutexW
DebugBreak
GetDriveTypeW
CreateFileW
WideCharToMultiByte
CloseHandle
DeviceIoControl
CreateFileA
GetVersion
GetLastError
lstrcpyW
InitializeCriticalSection
QueryDosDeviceW
InterlockedIncrement
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
lstrlenW
GetModuleFileNameW
FreeLibrary
GetProcAddress
LoadLibraryW
GetVersionExW
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
MultiByteToWideChar
lstrcmpiW
RaiseException
lstrcpynW
lstrcatW
GlobalAddAtomW
GlobalDeleteAtom
lstrlenA
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetFileAttributesW
SetLastError
GetExitCodeThread
DeleteCriticalSection
ExpandEnvironmentStringsW
CompareStringW
CompareStringA

advapi32

RegQueryValueExW
TraceMessage
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW

ole32

CreateStreamOnHGlobal
OleLockRunning
CoCreateInstance
CoTaskMemFree
StringFromGUID2
CoInitializeEx
CoUninitialize
CoMarshalInterface
CoUnmarshalInterface
RegisterDragDrop
RevokeDragDrop
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

VariantInit
VariantClear
SysStringLen
RegisterTypeLi
VarUI4FromStr
SysAllocString
SysFreeString
SysAllocStringLen
LoadRegTypeLi
VariantCopy
VariantChangeType
LoadTypeLi

user32

FillRect
SetForegroundWindow
CharPrevW
SetWindowPos
SendMessageW
EnumWindows
GetClassNameW
GetParent
FindWindowW
IsWindowVisible
ShowWindow
PostMessageW
CharNextW
LoadCursorW
RegisterClassW
CreateWindowExW
SetLayeredWindowAttributes
SetWindowLongW
BeginPaint
EndPaint
UnregisterClassW
DestroyAcceleratorTable
GetClientRect
CreateAcceleratorTableW
IsWindow
DestroyWindow
DefWindowProcW
InvalidateRgn
InvalidateRect
GetTopWindow
GetDC
SetFocus
GetFocus
KillTimer
IntersectRect
SetTimer
GetDesktopWindow
MonitorFromRect
GetMonitorInfoW
GetWindowLongW
GetWindow
GetWindowRect
EqualRect
SetRect
UnregisterHotKey
GetClassNameA
GetWindowThreadProcessId
SendMessageTimeoutA
GetAsyncKeyState
CharNextA
RegisterHotKey
IsIconic
ReleaseDC
GetCursorPos

gdi32

GetDeviceCaps

shell32

ShellExecuteExW

shlwapi

PathGetCharTypeW
PathGetCharTypeA

mpr

WNetAddConnection2W
WNetCancelConnection2W
WNetGetConnectionW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 99KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cef4fbca5da8f1ceb161e89d7b681856

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

uxtheme

kernel32

advapi32

ole32

oleaut32

user32

gdi32

shell32

shlwapi

mpr

Exports

Exports

Sections

.text Size: 81KB - Virtual size: 81KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 5KB - Virtual size: 4KB

.text Size: 99KB - Virtual size: 100KB

.text
Size: 81KB - Virtual size: 81KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 5KB - Virtual size: 4KB

.text
Size: 99KB - Virtual size: 100KB