241e248a33ea575966a2dbff3edffde7_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

241e248a33ea575966a2dbff3edffde7_JaffaCakes118
Size

336KB
MD5

241e248a33ea575966a2dbff3edffde7
SHA1

fe16ec42ccd85c8822c184ad64033dbb75582c54
SHA256

532b2eadcfac84046ce883d6bbc0b805e3197d4c28ab33169d65446a6d7d18e6
SHA512

644487a2c25696b151bd82efae4afbe84a119042e61c61e1f34519d9e61913d97cb81ce6f8fdb1e4ad586a6c652c63d16097bea2051c9ae56641e3e93d5cb1d8
SSDEEP

6144:1/vFKTBV/M3nMsVE4EkA6gD8rzHYPIX8yFrxYP/ydYlrsVmoaC/jMpU:1l3Xi3kY8YPZgYSYxOMpU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
241e248a33ea575966a2dbff3edffde7_JaffaCakes118

Files

241e248a33ea575966a2dbff3edffde7_JaffaCakes118
.dll windows:4 windows x86 arch:x86

78c428cc5d26182bf19c99afe33ed7de

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOverlappedResult
GetProcAddress
GetShortPathNameW
GetSystemDefaultLangID
GetSystemDirectoryA
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathW
GetTickCount
GetTimeFormatW
GetUserDefaultLangID
GetVersion
GetVersionExA
GetVersionExW
GetVolumeInformationW
GetVolumePathNameW
GlobalMemoryStatus
InitializeCriticalSection
InterlockedCompareExchange
InterlockedExchange
IsBadReadPtr
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LocalFree
MapViewOfFile
MoveFileExW
MoveFileW
MultiByteToWideChar
GetLogicalDriveStringsW
OpenProcess
OpenSemaphoreW
OutputDebugStringA
OutputDebugStringW
QueryDosDeviceW
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
RemoveDirectoryW
ResetEvent
SetEndOfFile
SetEvent
SetFileAttributesW
SetFilePointer
SetFileTime
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TerminateThread
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualQuery
WaitForMultipleObjectsEx
WaitForSingleObject
WaitNamedPipeW
WideCharToMultiByte
WriteFile
lstrcmpiA
lstrlenA
GetLocalTime
GetLastError
GetHandleInformation
GetFullPathNameW
GetFileTime
GetFileInformationByHandle
GetFileAttributesW
GetFileAttributesExW
GetFileAttributesA
GetExitCodeProcess
GetEnvironmentStringsW
GetDriveTypeW
GetDriveTypeA
GetDiskFreeSpaceW
GetDiskFreeSpaceExW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetComputerNameExW
GetACP
FreeLibrary
FreeEnvironmentStringsW
FormatMessageW
FormatMessageA
FlushFileBuffers
FindNextFileW
FindNextChangeNotification
FindFirstFileW
FindFirstChangeNotificationW
FindCloseChangeNotification
FindClose
ExitThread
EnterCriticalSection
DuplicateHandle
DeviceIoControl
DeleteFileW
DeleteCriticalSection
CreateThread
CreateProcessW
CreatePipe
CreateFileW
CreateFileMappingA
CreateFileA
CreateEventA
CreateDirectoryW
CloseHandle
OpenEventW
CancelIo

user32

UnhookWindowsHookEx
SetWindowsHookExA
RegisterWindowMessageW
PostThreadMessageA
PeekMessageA
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MessageBoxW
GetSystemMetrics
DispatchMessageA
CallNextHookEx

advapi32

RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
OpenThreadToken
OpenProcessToken
MapGenericMask
LookupPrivilegeValueA
LookupAccountNameW
LogonUserW
InitializeSecurityDescriptor
InitializeAcl
ImpersonateSelf
ImpersonateLoggedOnUser
GetUserNameW
GetTokenInformation
GetSecurityDescriptorControl
GetNamedSecurityInfoW
GetLengthSid
GetFileSecurityW
GetExplicitEntriesFromAclW
FreeSid
EqualSid
DuplicateTokenEx
DuplicateToken
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
CryptAcquireContextA
CheckTokenMembership
AllocateAndInitializeSid
AdjustTokenPrivileges
AddAccessAllowedAce
AccessCheck
RegQueryValueExA
RegQueryValueExW
RegSetKeySecurity
RegSetValueExA
RegSetValueExW
RevertToSelf
SetEntriesInAclW
SetSecurityDescriptorControl
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
RegOpenKeyExA

ole32

CoCreateInstance
CoUninitialize
CoSetProxyBlanket
CoInitialize
CoInitializeEx
CoQueryProxyBlanket
CoInitializeSecurity
CoTaskMemFree

ws2_32

inet_ntoa
socket
WSACleanup
WSACreateEvent
WSADuplicateSocketA
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSASetLastError
WSASocketA
WSAStartup
accept
bind
closesocket
connect
gethostbyaddr
setsockopt
gethostname
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
gethostbyname
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
send

winmm

waveOutGetDevCapsW
waveOutGetNumDevs

crypt32

CertGetCertificateChain
CertGetNameStringW
CertFreeCertificateContext
CertFreeCertificateChain
CertCreateCertificateContext

winspool.drv

SetPrinterW
OpenPrinterW
GetPrinterW
EnumPrintersW
ClosePrinter

Exports

Exports

SqmAddToAverage
SqmAddToStream
SqmAddToStreamDWord
SqmAddToStreamString
SqmAddToStreamV
SqmCleanup
SqmClearFlags
SqmCreateNewId
SqmEndSession
SqmFlushSession
SqmGetEnabled
SqmGetFlags
SqmGetMachineId
SqmGetSession
SqmGetSessionStartTime
SqmGetUserId
SqmIncrement
SqmIsWindowsOptedIn
SqmReadSharedMachineId
SqmReadSharedUserId
SqmSet
SqmSetAppId
SqmSetAppVersion
SqmSetBits
SqmSetBool
SqmSetCurrentTimeAsUploadTime
SqmSetEnabled
SqmSetFlags
SqmSetIfMax
SqmSetIfMin
SqmSetMachineId
SqmSetString
SqmSetUserId
SqmStartSession
SqmStartUpload
SqmSysprepGeneralize
SqmSysprepSpecialize
SqmTimerAccumulate
SqmTimerAddToAverage
SqmTimerRecord
SqmTimerStart
SqmUnattendedSetup
SqmWaitForUploadComplete
SqmWriteSharedMachineId
SqmWriteSharedUserId

Sections

.text
Size: 232KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

78c428cc5d26182bf19c99afe33ed7de

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

ws2_32

winmm

crypt32

winspool.drv

Exports

Exports

Sections

.text Size: 232KB - Virtual size: 232KB

.rdata Size: 48KB - Virtual size: 48KB

.data Size: 20KB - Virtual size: 1.7MB

.idata Size: 8KB - Virtual size: 8KB

.rsrc Size: 24KB - Virtual size: 24KB

.text
Size: 232KB - Virtual size: 232KB

.rdata
Size: 48KB - Virtual size: 48KB

.data
Size: 20KB - Virtual size: 1.7MB

.idata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 24KB - Virtual size: 24KB