24abeffde26edd53f33187fb46068876_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

24abeffde26edd53f33187fb46068876_JaffaCakes118
Size

130KB
MD5

24abeffde26edd53f33187fb46068876
SHA1

4090826c80c9f661ebb7e92c3bb60ada92594c4e
SHA256

988157b737163deaafdb8157dbc3d37c05dadc4433a864d7c811cf23087e86f2
SHA512

ce65194fbbfdfb79a7cd90dcad2aca34823fe7711c8ccc788a17292bf9753942b9c83fce1e321c49cee42cc5aac64a003b256cc004ff621269557cf6b8cba3a9
SSDEEP

3072:CQbDZnEG/J8kYkmqJBgqdmHs/yiVHFbWy1L:zDVEG/6kYvHsKz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
24abeffde26edd53f33187fb46068876_JaffaCakes118

Files

24abeffde26edd53f33187fb46068876_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

3d27f932080e23d2cce3edcacbd1430d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

upnp.pdb

Imports

msvcrt

wcscmp
_onexit
__dllonexit
_adjust_fdiv
malloc
_initterm
_wcsicmp
wcsncpy
_except_handler3
_wcsnicmp
wcsncmp
wcslen
_snwprintf
_wtol
strncmp
rand
wcsstr
free
sprintf

advapi32

RegQueryValueExW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW

kernel32

WideCharToMultiByte
CancelWaitableTimer
SetWaitableTimer
CreateWaitableTimerW
CreateTimerQueue
DeleteTimerQueue
DeleteTimerQueueTimer
DuplicateHandle
lstrcmpW
DelayLoadFailureHook
HeapFree
GetProcessHeap
HeapAlloc
HeapReAlloc
MultiByteToWideChar
lstrlenW
lstrcpyW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
lstrcpynW
HeapDestroy
lstrcatW
GetModuleFileNameW
FreeLibrary
GetProcAddress
LoadLibraryW
DisableThreadLibraryCalls
lstrlenA
SizeofResource
LoadResource
FindResourceW
GetLastError
LoadLibraryExW
GetShortPathNameW
InterlockedCompareExchange
LoadLibraryA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsBadWritePtr
IsBadCodePtr
IsBadStringPtrW
CloseHandle
SetEvent
CreateThread
CreateEventW
InterlockedExchange
Sleep
TryEnterCriticalSection
IsBadReadPtr
QueueUserWorkItem
DeleteTimerQueueEx
CreateTimerQueueTimer

ole32

CoInitializeEx
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance

oleaut32

VARIANT_UserUnmarshal
VARIANT_UserMarshal
VARIANT_UserSize
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserSize
SysAllocString
VarUI4FromStr
LoadTypeLi
RegisterTypeLi
LoadRegTypeLi
SysStringLen
VariantClear
VariantInit
VariantCopy
SafeArrayPutElement
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayGetUBound
SysAllocStringLen
SafeArrayCreate
VariantChangeType
VARIANT_UserFree
SysFreeString
SafeArrayRedim
SafeArrayGetElement

user32

PeekMessageW
TranslateMessage
DispatchMessageW
CharNextW
wsprintfW
MsgWaitForMultipleObjectsEx

rpcrt4

CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
CStdStubBuffer_AddRef
CStdStubBuffer_QueryInterface
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrCStdStubBuffer2_Release
NdrDllRegisterProxy
NdrDllUnregisterProxy
CStdStubBuffer_DebugServerRelease
NdrStubForwardingFunction
NdrStubCall2

winhttp

WinHttpSetOption
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpCrackUrl
WinHttpCloseHandle
WinHttpConnect
WinHttpSetStatusCallback
WinHttpOpen
WinHttpSetTimeouts

ssdpapi

RegisterNotification
DHSetICSInterfaces
SsdpStartup
FindServicesCallback
SsdpCleanup
FindServicesClose
FindServicesCancel
FreeSsdpMessage
DeregisterNotification
DHSetICSOff

ws2_32

WSAStartup
WSACleanup
freeaddrinfo
getaddrinfo
inet_addr

iphlpapi

GetAdaptersInfo
GetRTTAndHopCount

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
HrRehydratorCreateServiceObject
HrRehydratorInvokeServiceAction

Sections

.text
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 267B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3d27f932080e23d2cce3edcacbd1430d

Headers

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

ole32

oleaut32

user32

rpcrt4

winhttp

ssdpapi

ws2_32

iphlpapi

Exports

Exports

Sections

.text Size: 101KB - Virtual size: 100KB

.orpc Size: 512B - Virtual size: 267B

.data Size: 3KB - Virtual size: 3KB

.rsrc Size: 18KB - Virtual size: 18KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 101KB - Virtual size: 100KB

.orpc
Size: 512B - Virtual size: 267B

.data
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 18KB - Virtual size: 18KB

.reloc
Size: 6KB - Virtual size: 6KB