2481fb0da9b6b40ff06077f294d24e84_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2481fb0da9b6b40ff06077f294d24e84_JaffaCakes118
Size

464KB
MD5

2481fb0da9b6b40ff06077f294d24e84
SHA1

7ff5f19807a99be1c04b22f3db051f20476b2acd
SHA256

51f258d0cdd7110db715291e5298cbab57d61583377585d57c44c2cb9d2142df
SHA512

770d91e48471feb233515678f52c8f0548e92e26706145f7e2d13811b6df807d29014cb30c4003fbe546ca549a41dbab844c4239d4cd6e44ca326e24cd902a9a
SSDEEP

12288:FqiRXgm55fUgeoQqwmp/Wl+baVj2DvowrbHO9:FH5558geoQqw+WlfVj2DvLHO9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2481fb0da9b6b40ff06077f294d24e84_JaffaCakes118

Files

2481fb0da9b6b40ff06077f294d24e84_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

1d2ce62e8e3a490421f706f107acee25

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\workarea\8.60\install\utils\cds\2.0\atiicdxx.dll\B_rel\atiicdxx.pdb

Imports

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

setupapi

SetupDiGetClassDescriptionA
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW

msi

ord115
ord91
ord31
ord159
ord160
ord117
ord8
ord166
ord158
ord116

kernel32

lstrlenA
GetModuleFileNameA
GetLastError
RaiseException
WideCharToMultiByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
GetUserDefaultLCID
MultiByteToWideChar
GetEnvironmentVariableA
DeleteFileA
lstrcpyA
lstrcatA
OpenFile
GetShortPathNameA
GetWindowsDirectoryA
CloseHandle
CopyFileA
CreateDirectoryA
CreateFileA
GetOverlappedResult
DeviceIoControl
CreateEventA
HeapFree
HeapAlloc
GetProcessHeap
GetTimeFormatA
GetStringTypeW
GetStringTypeA
WriteFile
UnhandledExceptionFilter
GetEnvironmentStringsW
GetModuleHandleA
lstrlenW
GetThreadLocale
GetLocaleInfoA
GetACP
GetVersionExA
InterlockedExchange
GetCurrentThread
GetThreadPriority
SetThreadPriority
GetDateFormatA
GetCPInfo
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetOEMCP
SetFilePointer
IsBadReadPtr
IsBadCodePtr
GetTimeZoneInformation
QueryPerformanceCounter
Sleep
GetTickCount
GetCurrentProcessId
SetStdHandle
FlushFileBuffers
ReadFile
SetConsoleCtrlHandler
SetEndOfFile
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
OutputDebugStringA
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
LCMapStringW
LCMapStringA
HeapSize
SetUnhandledExceptionFilter
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
FatalAppExitA
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
GetCommandLineA
GetCurrentThreadId
GetSystemTimeAsFileTime
GetCurrentProcess
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlUnwind
HeapReAlloc
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileA
FindNextFileA
ExitProcess
TerminateProcess

user32

wsprintfA
LoadStringA
EnumDisplaySettingsA
UnregisterClassA
CharNextA

advapi32

InitializeAcl
CreateServiceA
StartServiceA
OpenSCManagerA
OpenServiceA
ControlService
DeleteService
CloseServiceHandle
RegEnumValueA
AllocateAndInitializeSid
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
AddAccessAllowedAce
SetSecurityDescriptorDacl
FreeSid
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptDecrypt
CryptDestroyHash
CryptDestroyKey
CryptReleaseContext
RegEnumKeyA
RegQueryValueExA
RegQueryInfoKeyA
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey

ole32

CoInitialize
StringFromGUID2
CoSetProxyBlanket
CoUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree

oleaut32

SysAllocString
VarUI4FromStr
SysStringByteLen
SysAllocStringByteLen
UnRegisterTypeLi
RegisterTypeLi
VariantInit
VariantClear
SysStringLen
LoadTypeLi
LoadRegTypeLi
SysAllocStringLen
SysFreeString

shlwapi

PathFindExtensionA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
DoDetection
DoDetectionEx
QueryValue
QueryValueString

Sections

.text
Size: 288KB - Virtual size: 287KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1d2ce62e8e3a490421f706f107acee25

Headers

File Characteristics

PDB Paths

Imports

version

setupapi

msi

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 288KB - Virtual size: 287KB

.rdata Size: 60KB - Virtual size: 58KB

.data Size: 8KB - Virtual size: 129KB

.rsrc Size: 8KB - Virtual size: 5KB

.reloc Size: 20KB - Virtual size: 17KB

.text Size: 76KB - Virtual size: 76KB

.text
Size: 288KB - Virtual size: 287KB

.rdata
Size: 60KB - Virtual size: 58KB

.data
Size: 8KB - Virtual size: 129KB

.rsrc
Size: 8KB - Virtual size: 5KB

.reloc
Size: 20KB - Virtual size: 17KB

.text
Size: 76KB - Virtual size: 76KB