1978d661b88fe88dddca10da68ed68f5_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

1978d661b88fe88dddca10da68ed68f5_JaffaCakes118
Size

544KB
MD5

1978d661b88fe88dddca10da68ed68f5
SHA1

650089f6375669ae8f34275fbc3f324cb01cff22
SHA256

456a9f83f8b74df8c1fa71f0eab45fe48454daac35e6734de7c788a1068c4037
SHA512

d3dfb73796f0c56d304035eab8bf5d2bcca69f420fce55adbf708a05b671e7ee6dcd6f5cca19133f36ac5c09e095dba6990d35cd0043d23ea80bb8af60c9f174
SSDEEP

12288:xondt+sAUwLqiz1ZzrMwmfvcr53VbzpvXyTwYBI:xondb+qixZzgvAzs8G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1978d661b88fe88dddca10da68ed68f5_JaffaCakes118

Files

1978d661b88fe88dddca10da68ed68f5_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

8022807f90d45028b61449e129bcbd17

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Dvlp\net7\vc\Bar\4.3.2.0\HbCoreSrv\ReleaseMinDependency\HbCoreSrv.pdb

Imports

wsock32

WSACleanup
WSAStartup

comctl32

ord17

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

kernel32

lstrcpynA
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
HeapAlloc
GetProcessHeap
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
CreateSemaphoreA
CloseHandle
LocalAlloc
FormatMessageA
DeleteFileA
ReleaseSemaphore
WaitForSingleObject
FindClose
FindNextFileA
FindFirstFileA
lstrcmpA
GetProcAddress
LoadLibraryA
ExpandEnvironmentStringsA
CreateFileA
HeapFree
Sleep
CopyFileA
GetVersion
CompareStringA
CompareStringW
lstrcmpiW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetStringTypeExA
GetStringTypeExW
ReadFile
GetFileSize
CreateDirectoryA
GetTickCount
SetFileTime
SystemTimeToFileTime
FileTimeToSystemTime
GetFileTime
OpenFile
ResumeThread
SetThreadPriority
TerminateThread
CreateThread
TlsSetValue
TlsGetValue
WriteFile
SetFilePointer
MoveFileA
GetModuleHandleA
GetCurrentProcessId
GetLocaleInfoA
TlsAlloc
SetUnhandledExceptionFilter
VirtualQuery
DisableThreadLibraryCalls
GetCurrentThread
OutputDebugStringA
CreateProcessA
RemoveDirectoryA
SetEvent
ResetEvent
PulseEvent
WaitForMultipleObjects
ReleaseMutex
CreateMutexA
CreateEventA
SetLastError
GlobalAlloc
GlobalFree
GetVolumeInformationA
GetStringTypeW
GetStringTypeA
GetSystemInfo
VirtualProtect
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetTimeZoneInformation
GetCPInfo
GetOEMCP
LCMapStringW
LCMapStringA
HeapSize
TerminateProcess
FlushFileBuffers
TlsFree
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
FatalAppExitA
ExitProcess
GetLocalTime
GetSystemTimeAsFileTime
GetDateFormatA
GetTimeFormatA
GetCommandLineA
HeapReAlloc
RtlUnwind
RaiseException
LocalFree
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
SetConsoleCtrlHandler
GetACP
InterlockedExchange
SetEndOfFile
GetLocaleInfoW
SetEnvironmentVariableA
QueryPerformanceCounter
MulDiv
GetModuleFileNameA
lstrcatA
lstrcpyA
lstrcmpiA
lstrlenA
InterlockedDecrement
InterlockedIncrement
GetLastError
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
IsBadWritePtr
GetThreadLocale
SetStdHandle
UnhandledExceptionFilter
GetSystemTime
IsBadReadPtr
IsBadCodePtr

user32

GetPropA
GetParent
GetWindowRect
EnumWindows
SetPropA
EnumChildWindows
GetClassNameA
MsgWaitForMultipleObjects
PostThreadMessageA
LoadBitmapA
LoadStringA
GetWindowTextA
PeekMessageA
TranslateMessage
DispatchMessageA
GetMessageA
CharUpperW
CharUpperA
CharLowerW
CharLowerA
PostMessageA
CreateDialogParamA
IsWindow
GetTopWindow
GetWindow
GetDlgItem
SetDlgItemTextA
ShowWindow
SendMessageA
DestroyWindow
GetClassInfoExA
LoadCursorA
RegisterClassExA
CreateWindowExA
wsprintfA
GetFocus
IsChild
BeginPaint
GetClientRect
EndPaint
CallWindowProcA
GetWindowLongA
DefWindowProcA
SetWindowLongA
GetDC
ReleaseDC
CharNextA
UnregisterClassA
SetWindowTextA

gdi32

BitBlt
CreateDIBSection
CreateFontIndirectA
CreateDCA
GetDeviceCaps
LPtoDP
SelectObject
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
DeleteDC
RestoreDC
SetTextAlign
TextOutA
SaveDC
CreateCompatibleDC

advapi32

RegCreateKeyExA
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegQueryValueExA
RegEnumValueA
RegEnumKeyA
RegCloseKey

ole32

CoTaskMemAlloc
CoCreateInstance
StringFromGUID2
CoCreateGuid
CoInitialize
CoUninitialize
CoTaskMemFree
CoTaskMemRealloc

oleaut32

SysStringLen
SysAllocStringByteLen
SysStringByteLen
SafeArrayCreate
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
VariantChangeType
SafeArrayCopy
SafeArrayDestroy
SafeArrayPutElement
CreateErrorInfo
GetErrorInfo
SetErrorInfo
LoadRegTypeLi
SysFreeString
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VariantClear
VariantInit
VarUI4FromStr

shlwapi

StrToIntA
PathFindExtensionA
StrRChrA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 352KB - Virtual size: 350KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8022807f90d45028b61449e129bcbd17

Headers

File Characteristics

PDB Paths

Imports

wsock32

comctl32

version

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 352KB - Virtual size: 350KB

.rdata Size: 104KB - Virtual size: 101KB

.data Size: 16KB - Virtual size: 24KB

.rsrc Size: 40KB - Virtual size: 38KB

.reloc Size: 28KB - Virtual size: 26KB

.text
Size: 352KB - Virtual size: 350KB

.rdata
Size: 104KB - Virtual size: 101KB

.data
Size: 16KB - Virtual size: 24KB

.rsrc
Size: 40KB - Virtual size: 38KB

.reloc
Size: 28KB - Virtual size: 26KB