2330ff9c41c99648582e88d4ca1572cf_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

2330ff9c41c99648582e88d4ca1572cf_JaffaCakes118
Size

601KB
MD5

2330ff9c41c99648582e88d4ca1572cf
SHA1

ae55d5c0242b85c92535102fc6e14fcf2922bcf7
SHA256

032986acb2febe1dea8fa6a9848127ed19bad4480cd2afc36720a8d25420b749
SHA512

a8bb0e1bf94bdfc59044e9a80a4cff97423cf26f5ad77f150e0adf0fa9e5782790816c1c113b60ff6f6024ee2a3c7fd070b7abd7f6b6fd76ebb582cda310809b
SSDEEP

12288:QXikiW2mWfmxYl5u4PIYpJrgrezUJPNa0iJjNE5I4CqBNWbLzHW:6iO2mWeSl84PVpJrwmUmjGI4CqBNWbLj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2330ff9c41c99648582e88d4ca1572cf_JaffaCakes118

Files

2330ff9c41c99648582e88d4ca1572cf_JaffaCakes118
.dll windows:5 windows x86 arch:x86

9ab6543bdfd80737811e62eeca640b36

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

InternetGetConnectedState

shell32

SHGetFolderPathA
ShellExecuteExA
SHFileOperationA

kernel32

GetCurrentThreadId
lstrcmpA
GetVersionExA
GlobalAlloc
GlobalFree
IsDBCSLeadByte
GlobalLock
FreeLibrary
lstrcmpiA
InterlockedIncrement
GlobalUnlock
MulDiv
GetShortPathNameA
GetCurrentProcess
DeviceIoControl
TerminateProcess
WaitForSingleObject
OpenProcess
GetVersion
Sleep
DeleteFileA
WritePrivateProfileStringA
CreateThread
CreateProcessA
GetPrivateProfileIntA
GetPrivateProfileStringA
IsWow64Process
GetExitCodeProcess
Process32First
CreateToolhelp32Snapshot
Process32Next
GetCurrentProcessId
CreateMutexW
LoadLibraryW
FindFirstFileA
FindNextFileA
FindClose
Process32FirstW
Process32NextW
GetWindowsDirectoryA
CopyFileA
GetWindowsDirectoryW
GetTickCount
GetModuleHandleW
WriteConsoleW
CreateFileW
SetStdHandle
GetCommandLineW
GetCommandLineA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
MoveFileExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleCP
GetACP
GetFileType
GetStdHandle
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetModuleHandleExW
ExitProcess
FindResourceA
VirtualProtect
GetSystemInfo
InterlockedFlushSList
GetModuleFileNameW
LoadLibraryExW
RtlUnwind
QueryPerformanceCounter
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
SetEvent
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
LoadLibraryExA
InterlockedDecrement
EnterCriticalSection
SetLastError
GlobalHandle
GetProcAddress
GetModuleHandleA
FlushFileBuffers
CreateDirectoryA
GetSystemTimeAsFileTime
WideCharToMultiByte
GetFileSize
FindResourceW
LoadResource
FindResourceExW
CloseHandle
LockResource
CreateFileA
GetFileAttributesA
MultiByteToWideChar
SetEndOfFile
SetFilePointer
WriteFile
GetFileSizeEx
SizeofResource
GetModuleFileNameA
ReadFile
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionAndSpinCount
HeapFree
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
VirtualQuery
LeaveCriticalSection

user32

GetWindowTextLengthA
GetParent
RegisterClassExA
ReleaseCapture
InvalidateRect
ReleaseDC
GetDesktopWindow
GetDlgItem
GetClientRect
MapDialogRect
SetCapture
SendMessageA
SetWindowContextHelpId
SendDlgItemMessageA
SetFocus
CreateWindowExA
BeginPaint
DefWindowProcA
MoveWindow
EndPaint
GetSysColor
SetMenuDefaultItem
SetWindowTextA
GetWindowLongA
CreateAcceleratorTableA
IsChild
EnableWindow
UnregisterClassA
GetMenuItemInfoA
GetWindowThreadProcessId
PostMessageA
MessageBoxA
EnumWindows
CharNextA
CheckMenuRadioItem
GetWindow
GetFocus
LoadCursorA
DestroyWindow
GetDC
SetWindowPos
FillRect
ScreenToClient
EndDialog
GetClassNameA
GetActiveWindow
IsWindow
DialogBoxIndirectParamA
InvalidateRgn
GetClassInfoExA
RegisterWindowMessageA
RedrawWindow
IsDialogMessageA
SetMenuItemInfoA
SetWindowLongA
ClientToScreen
CallWindowProcA
DestroyAcceleratorTable
GetWindowTextA

gdi32

BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetStockObject
GetDeviceCaps
DeleteDC
DeleteObject
CreateSolidBrush
GetObjectA

advapi32

SystemFunction036
RegDeleteValueA
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
CreateServiceA
ControlService
QueryServiceStatus
QueryServiceStatusEx
StartServiceW
OpenServiceW
OpenSCManagerW
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CloseServiceHandle
OpenSCManagerA
DeleteService
OpenServiceA
RegDeleteKeyA
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyA
RegQueryValueExA
RegCreateKeyExA
RegEnumKeyExW
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA

ole32

OleUninitialize
CoGetClassObject
CoTaskMemAlloc
CoCreateGuid
OleLockRunning
CLSIDFromString
CoTaskMemRealloc
OleInitialize
CreateStreamOnHGlobal
CoTaskMemFree
CLSIDFromProgID
CoCreateInstance
StringFromGUID2

oleaut32

DispCallFunc
VarUI4FromStr
VariantInit
SysAllocString
VariantCopy
VarBstrCmp
LoadRegTypeLi
LoadTypeLi
OleCreateFontIndirect
SysStringLen
SysFreeString
VariantClear
SysAllocStringLen

winhttp

WinHttpSendRequest
WinHttpCrackUrl
WinHttpConnect
WinHttpSetTimeouts
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpReadData
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpOpen
WinHttpQueryDataAvailable

crypt32

CertCloseStore
CertAddEncodedCertificateToStore
CertOpenSystemStoreA

winmm

waveOutGetVolume
waveOutSetVolume

iphlpapi

GetAdaptersAddresses

Exports

Exports

CenjSulshc
DhpawuHied
EagovrMook
EdiqLedsonx
FebteNitfe
FeobuwDabdo
GegmeOtitteo
GocuwoNavjuss
HeayjmUarup
HhabCawxaln
JurpAcu
LiecroVaroc
LizkerLufutin
MijruzToj
NeavAfa
NhqiNafobo
NujbKan
OkoecwIniop
OoyagaKamdanw
OpaiIag
OwaehNuwryix
PeljinAnylsar
PhfuerJodunu
RupqSended
SeuqokAcevne
SiadbIjuinb
SuffoTidpue
UuecazNio
VutviSeehfe
WadeUpelbab
WhioseMelwy
WudatiPobbamu
XixjatBubkeo

Sections

.text
Size: 435KB - Virtual size: 434KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9ab6543bdfd80737811e62eeca640b36

Headers

DLL Characteristics

File Characteristics

Imports

wininet

shell32

kernel32

user32

gdi32

advapi32

ole32

oleaut32

winhttp

crypt32

winmm

iphlpapi

Exports

Exports

Sections

.text Size: 435KB - Virtual size: 434KB

.rdata Size: 120KB - Virtual size: 119KB

.data Size: 6KB - Virtual size: 11KB

.gfids Size: 1024B - Virtual size: 584B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 35KB - Virtual size: 35KB

.text
Size: 435KB - Virtual size: 434KB

.rdata
Size: 120KB - Virtual size: 119KB

.data
Size: 6KB - Virtual size: 11KB

.gfids
Size: 1024B - Virtual size: 584B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 35KB - Virtual size: 35KB