25807b428727aaded8409abc1ba7beff_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

25807b428727aaded8409abc1ba7beff_JaffaCakes118
Size

216KB
MD5

25807b428727aaded8409abc1ba7beff
SHA1

677db604aa14aaddc343fe9ada4a0be4290c7ad0
SHA256

5de61bda37774a9d5790ff6b6018f43035530f12bf761763bf797451aa28dcff
SHA512

bf92309ccc580308e22c1460612786ddb4ca5f5de562886a279240772c6d6930c8a52ed982525b8529ddc7beb4edfcd636c7bd76a2ae7b5439fa3bcb17fd685e
SSDEEP

3072:R35FaBsVrkh1LmGeF02zpuL778AjzBxPQE7dlCXLZ2BCYLE:qdpYF02cv78a1x17qXEE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
25807b428727aaded8409abc1ba7beff_JaffaCakes118

Files

25807b428727aaded8409abc1ba7beff_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

ea6a4cd8a2dd68b3c32f48cd22996ac4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyW
lstrcatW
GetVersionExW
CreateEventW
InitializeCriticalSectionAndSpinCount
GetExitCodeThread
SetEvent
CancelIo
ResetEvent
WaitForMultipleObjects
DuplicateHandle
GetCurrentProcess
TerminateThread
CreateRemoteThread
TerminateProcess
WaitForSingleObject
ProcessIdToSessionId
GetCurrentProcessId
SetThreadPriority
Sleep
DeleteFileW
CreateFileW
GetTempFileNameW
GetTempPathW
FindClose
FindNextFileW
GetSystemTimeAsFileTime
GetFileTime
FindFirstFileW
OpenProcess
InterlockedExchange
LoadLibraryW
LocalFree
GetComputerNameW
GetTimeZoneInformation
lstrcpynW
VirtualFreeEx
VirtualAllocEx
GetTickCount
CreateDirectoryW
GetCurrentThreadId
GlobalUnlock
GlobalLock
GlobalSize
GetSystemTime
HeapReAlloc
GetSystemDirectoryW
GetCommandLineA
GetLocalTime
ExitThread
GetProcAddress
HeapDestroy
lstrcmpiW
GetModuleFileNameW
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
LoadLibraryA
GetOEMCP
GetModuleHandleW
GetShortPathNameW
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
lstrlenW
FreeLibrary
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
SetFilePointer
GetLastError
GetFileSize
GetProcessHeap
HeapAlloc
ReadFile
WriteFile
HeapFree
CloseHandle
DisableThreadLibraryCalls
InterlockedExchangeAdd
GetACP
CreateFileA
SetStdHandle
IsBadCodePtr
IsBadReadPtr
GetCPInfo
SetUnhandledExceptionFilter
TlsGetValue
TlsSetValue
CreateThread
RtlUnwind
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
ReleaseSemaphore
ReleaseMutex
CreateMutexW
CreateSemaphoreW
GlobalAlloc
GlobalReAlloc
GlobalFree
RaiseException
ExitProcess
HeapSize
TlsAlloc
TlsFree
SetLastError
GetModuleHandleA
GetModuleFileNameA
FlushFileBuffers
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
UnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
GetVersionExA
GetEnvironmentVariableA
GetVersion

user32

CharLowerW
MessageBoxW
LoadStringW
CharNextW
KillTimer
SetTimer
GetWindowThreadProcessId

advapi32

RegSetKeySecurity
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegGetKeySecurity
RegOpenKeyW
LookupAccountNameW
ConvertSidToStringSidW
RegQueryValueExW
RegEnumKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegSetValueExW
CryptEncrypt
CryptDecrypt
CryptDestroyKey
CryptDeriveKey

ole32

CoInitializeEx
GetHGlobalFromStream
CoUninitialize
CoCreateInstance
StringFromCLSID
CreateStreamOnHGlobal
CoTaskMemFree
OleRun

oleaut32

VariantChangeType
VariantCopy
SafeArrayRedim
VariantInit
SafeArrayGetElement
SafeArrayCreate
SafeArrayPutElement
SafeArrayDestroy
SysStringByteLen
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreateVector
VariantClear
VarI4FromStr
LoadRegTypeLi
RegisterTypeLi
LoadTypeLi
SysAllocStringLen
VarBstrFromI4
VarBstrFromR8
SysStringLen
SysFreeString
SysAllocString
GetErrorInfo

rpcrt4

UuidCreate

wininet

InternetCloseHandle
InternetGetConnectedState
InternetOpenW
HttpQueryInfoW
InternetConnectW
HttpSendRequestW
HttpOpenRequestW
InternetReadFile

iphlpapi

GetRTTAndHopCount
NotifyAddrChange

ws2_32

inet_addr

sensapi

IsNetworkAlive

wtsapi32

WTSQuerySessionInformationW
WTSOpenServerW
WTSCloseServer
WTSFreeMemory

netapi32

NetWkstaUserEnum
NetApiBufferFree

shlwapi

PathFileExistsW
SHCreateStreamOnFileW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GeoLocate
Request

Sections

.text
Size: 140KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ea6a4cd8a2dd68b3c32f48cd22996ac4

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

rpcrt4

wininet

iphlpapi

ws2_32

sensapi

wtsapi32

netapi32

shlwapi

Exports

Exports

Sections

.text Size: 140KB - Virtual size: 138KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 24KB - Virtual size: 28KB

.rsrc Size: 8KB - Virtual size: 6KB

.reloc Size: 16KB - Virtual size: 14KB

.text
Size: 140KB - Virtual size: 138KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 24KB - Virtual size: 28KB

.rsrc
Size: 8KB - Virtual size: 6KB

.reloc
Size: 16KB - Virtual size: 14KB