22552352bb0c0dfd63e328ac121c1327_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

22552352bb0c0dfd63e328ac121c1327_JaffaCakes118
Size

472KB
MD5

22552352bb0c0dfd63e328ac121c1327
SHA1

29ab458b6013090ecb4b8590da4009c6e6675383
SHA256

47bdb63fb60a473a41d503b72ab2fd89931b22a046fc5354ca8e5b9a6d92c6d4
SHA512

dad606e8bf781ebd356526fdad29d29377813c84ad56f40fdcaf8e7320d449fc17f6a73db3202d1b97d9287dd077d89fc3cd74208719c9ac3a4d8b53f9038f20
SSDEEP

12288:tGaFsw14SVTch/HZ0ccv/Qre3aan8Zb+i47h:pP14Ech/HZ0ccv/0eqaCbHYh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
22552352bb0c0dfd63e328ac121c1327_JaffaCakes118

Files

22552352bb0c0dfd63e328ac121c1327_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

3a94499a082e6551330f3fb61e26aa74

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

RtlUnwind

user32

GetCursor
LoadIconW
GetClassInfoExW
GetClassNameW
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
GetDoubleClickTime
BeginPaint
EndPaint
SystemParametersInfoW
IntersectRect
GetIconInfo
MapVirtualKeyW
SendInput
keybd_event
GetSysColor
GetCursorPos
SetWindowRgn
TrackPopupMenuEx
EnableMenuItem
CheckMenuItem
SetMenuItemInfoW
GetMenuItemInfoW
GetMenuItemCount
GetMenuItemID
IsMenu
GetActiveWindow
GetForegroundWindow
GetCaretPos
SetCaretPos
GetClientRect
IsRectEmpty
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
SetWindowPos
GetWindow
DestroyIcon
ClientToScreen
DrawTextW
LoadImageW
DrawIconEx
DestroyCursor
GetDlgCtrlID
ScreenToClient
ChildWindowFromPointEx
LoadMenuW
GetSubMenu
TrackPopupMenu
DestroyMenu
IsWindowEnabled
CheckRadioButton
IsWindowVisible
SetWindowTextW
RedrawWindow
GetFocus
SetFocus
EnableWindow
GetWindowRect
MoveWindow
CheckDlgButton
GetDlgItem
DialogBoxIndirectParamW
GetWindowTextW
MessageBoxW
EndDialog
SetPropW
SetRect
OffsetRect
LoadCursorW
SetCursor
InvertRect
GetPropW
RemovePropW
CallWindowProcW
PtInRect
DrawFocusRect
InvalidateRect
UpdateWindow
DrawEdge
FillRect
LoadBitmapW
CopyImage
GetKeyboardState
UnloadKeyboardLayout
LoadKeyboardLayoutW
RegisterWindowMessageW
SendMessageW
ActivateKeyboardLayout
RegisterClassExW
CreateWindowExW
DefWindowProcW
LoadStringW
MessageBeep
VkKeyScanW
EnumWindows
GetKeyState
GetKeyboardLayoutList
ReleaseDC
GetDC
ToAscii
ToUnicode
PostMessageW
ReleaseCapture
SetCapture
GetCapture
EqualRect
GetUpdateRect
IsDlgButtonChecked
wsprintfW
IsWindow
DestroyWindow
UnregisterClassW
KillTimer
SetTimer
GetWindowLongW
SetWindowLongW

kernel32

FlushFileBuffers
SetStdHandle
GetLocaleInfoA
VirtualQuery
VirtualProtect
GetStringTypeW
GetStringTypeA
LoadLibraryA
IsBadWritePtr
GetCPInfo
GetOEMCP
GetACP
SetUnhandledExceptionFilter
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceW
CloseHandle
WaitForMultipleObjects
ReleaseMutex
ResetEvent
ReleaseSemaphore
WaitForSingleObject
SetEvent
CreateSemaphoreW
CreateEventW
CreateMutexW
lstrlenW
VirtualAlloc
GetSystemInfo
UnmapViewOfFile
MapViewOfFileEx
OpenFileMappingW
CreateFileMappingW
DeleteFileW
GetFileSize
CreateFileW
GetLastError
SetEndOfFile
SetFilePointer
WriteFile
FreeLibrary
lstrcatW
lstrcpyW
GetProcAddress
LoadLibraryW
InterlockedIncrement
InterlockedDecrement
ReadFile
GetSystemTime
MultiByteToWideChar
IsBadCodePtr
IsBadReadPtr
GlobalFree
GlobalUnlock
GlobalHandle
GlobalLock
GlobalAlloc
TlsAlloc
TlsSetValue
TlsGetValue
GetModuleHandleW
TlsFree
GetCurrentProcessId
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetFullPathNameW
GetModuleFileNameW
GetWindowsDirectoryW
GetSystemDirectoryW
CreateDirectoryW
ExpandEnvironmentStringsW
GetComputerNameW
FindResourceExW
GetCurrentProcess
GetCurrentThread
GetVersionExW
lstrcmpA
lstrcpyA
HeapFree
HeapAlloc
GetProcessHeap
MapViewOfFile
lstrcmpiW
lstrcmpW
lstrlenA
lstrcatA
GetModuleFileNameA
CompareStringW
GetShortPathNameW
GetSystemDefaultLangID
CreateThread
lstrcpynW
GetVersionExA
CreateProcessW
OpenEventW
GetCommandLineA
RaiseException
ExitProcess
GetModuleHandleA
SetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
LCMapStringA
LCMapStringW
HeapReAlloc
HeapSize

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
GetUserNameW
GetTokenInformation
OpenProcessToken
OpenThreadToken
RegEnumKeyExA
RegOpenKeyExA
RegCreateKeyExW
EqualSid
RegEnumKeyExW
RegEnumValueW
RegSetValueExW
RegDeleteValueW
FreeSid
IsValidSecurityDescriptor
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
IsValidAcl
AddAccessAllowedAce
GetLengthSid
AllocateAndInitializeSid
GetSecurityDescriptorDacl
RegDeleteKeyW
RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyW
RegQueryValueExA
InitializeAcl

gdi32

SetTextAlign
GetTextExtentPoint32W
CreateCompatibleBitmap
GetStockObject
Rectangle
PatBlt
GetTextExtentExPointW
ModifyWorldTransform
CreateRectRgnIndirect
CombineRgn
GetTextColor
GetBkColor
ExtTextOutW
CreatePen
MoveToEx
LineTo
SetBkColor
LPtoDP
DPtoLP
SetBkMode
SetTextColor
TextOutW
GetObjectW
OffsetViewportOrgEx
CreatePatternBrush
CreateSolidBrush
CreateCompatibleDC
BitBlt
DeleteDC
CreateFontIndirectW
SelectObject
GetGlyphOutlineW
DeleteObject
SetPixel
GetPixel
CreateDIBitmap
GetDeviceCaps
SetWorldTransform
SetMapMode
SetGraphicsMode
GetBitmapBits
EnumFontFamiliesExW
GetTextMetricsW

ole32

ReleaseStgMedium
CoInitialize
CoUninitialize
CoGetClassObject
StringFromCLSID
CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance

oleaut32

SysStringLen
VariantClear
SysAllocStringLen
SysAllocString
SysFreeString
VariantInit

imm32

ImmLockIMCC
ImmLockIMC
ImmUnlockIMC
ImmUnlockIMCC
ImmGetConversionListW
ImmIsIME
ImmGetHotKey
ImmGetIMEFileNameW
ImmCreateIMCC
ImmDestroyIMCC
ImmReSizeIMCC
ImmGenerateMessage
ImmSetConversionStatus
ImmNotifyIME
ImmSetOpenStatus
ImmInstallIMEW
ImmAssociateContext
ImmGetContext
ImmGetConversionStatus

Exports

Exports

CreateIFELanguageInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
IntlIMEAnsiCodePage
IntlIMEMaxTokenLen
IntlIMEPatternToReading
IntlIMEReadingSize
IntlIMEReadingToPattern
IntlIMEWordReadingLength
NotifyIME
SetupIMEInformation

Sections

.text
Size: 385KB - Virtual size: 388KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 57KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.upx_
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3a94499a082e6551330f3fb61e26aa74

Headers

File Characteristics

Imports

ntdll

user32

kernel32

advapi32

gdi32

ole32

oleaut32

imm32

Exports

Exports

Sections

.text Size: 385KB - Virtual size: 388KB

.data Size: 9KB - Virtual size: 20KB

.rsrc Size: 57KB - Virtual size: 60KB

.reloc Size: 18KB - Virtual size: 20KB

.upx_ Size: 1KB - Virtual size: 4KB

.text
Size: 385KB - Virtual size: 388KB

.data
Size: 9KB - Virtual size: 20KB

.rsrc
Size: 57KB - Virtual size: 60KB

.reloc
Size: 18KB - Virtual size: 20KB

.upx_
Size: 1KB - Virtual size: 4KB