25f4e68f2146bf225b58db88bba6ab16_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

25f4e68f2146bf225b58db88bba6ab16_JaffaCakes118
Size

516KB
MD5

25f4e68f2146bf225b58db88bba6ab16
SHA1

ab8bc355eae9ebc9a039af3f9f4806959870b0cf
SHA256

d458c07051eacab31cf3f82fd0215d27ef11e6a7914ee376c50dfd6cab88d502
SHA512

e994300bc0a96c376a69be1bbbb272838e858555ede2d432554afde1eb564f8e5c9dc5e51af9393f54e8011b735b6f18801f0ae4086808e05eb203c5d26fe52b
SSDEEP

12288:ZIMWQKlpuSNjFo76cLsYQkF23Z6YAQw8vG5J/qFh8/V/:ZIMGlpuSFFvGsiI3Z6Y5vG5J/qFhM/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
25f4e68f2146bf225b58db88bba6ab16_JaffaCakes118

Files

25f4e68f2146bf225b58db88bba6ab16_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

326417f1e05d04a986e2c09891d771ed

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

kernel32

GlobalFlags
WritePrivateProfileStringA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
GetCurrentProcess
GetCPInfo
GetOEMCP
RtlUnwind
RaiseException
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
ExitProcess
TerminateProcess
HeapSize
GetACP
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetEnvironmentVariableA
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
GlobalUnlock
GlobalFree
TlsAlloc
LocalAlloc
GlobalLock
GlobalAlloc
GlobalDeleteAtom
lstrcmpA
GetCurrentThread
GetCurrentThreadId
LocalFree
SetLastError
FindNextFileW
FlushFileBuffers
SetFilePointer
ReadFile
WriteFile
CreateFileW
DeleteFileW
GetVersion
FindFirstFileW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetTimeZoneInformation
lstrcatA
lstrcpyA
LoadLibraryA
GetProcAddress
HeapDestroy
lstrcpynA
lstrcmpiA
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
WideCharToMultiByte
GetModuleHandleA
lstrlenA
MultiByteToWideChar
lstrlenW
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
IsDBCSLeadByte
GetFileAttributesA
DeleteFileA
GetShortPathNameA
CreateFileA
GetLastError
CloseHandle
FindFirstFileA
FindNextFileA
FindClose
GetLocalTime
GetVersionExA
GetModuleFileNameA

user32

GetMessagePos
GetMessageTime
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
DestroyWindow
DefWindowProcA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
DestroyMenu
GetForegroundWindow
SetForegroundWindow
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
SetFocus
ShowWindow
SetWindowPos
SetWindowLongA
GetDlgItem
GrayStringA
DrawTextA
TabbedTextOutA
ReleaseDC
GetDC
GetMenuItemCount
wsprintfA
GetWindowTextA
SetWindowTextA
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
PtInRect
GetClassNameA
LoadStringA
UnregisterClassA
UnhookWindowsHookEx
GetMenuCheckMarkDimensions
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
PeekMessageA
GetCursorPos
SetWindowsHookExA
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
MessageBoxA
EnableWindow
SetCursor
SendMessageA
PostMessageA
PostQuitMessage
CharNextA
CharPrevA
LoadBitmapA

gdi32

SetWindowExtEx
ScaleWindowExtEx
GetClipBox
SetViewportExtEx
GetDeviceCaps
SetBkColor
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetObjectA
GetStockObject
ScaleViewportExtEx
SelectObject
RestoreDC
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetTextColor
DeleteDC
DeleteObject
CreateBitmap
SaveDC

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegEnumValueA
RegQueryInfoKeyA
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegDeleteValueA
RegCreateKeyExA
RegDeleteKeyA

comctl32

ord17

ole32

CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance

oleaut32

SysFreeString
VarUI4FromStr
LoadTypeLi
RegisterTypeLi
SysAllocString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 320KB - Virtual size: 316KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

326417f1e05d04a986e2c09891d771ed

Headers

File Characteristics

Imports

version

kernel32

user32

gdi32

winspool.drv

advapi32

comctl32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 320KB - Virtual size: 316KB

.rdata Size: 40KB - Virtual size: 37KB

.data Size: 28KB - Virtual size: 42KB

.rsrc Size: 104KB - Virtual size: 103KB

.reloc Size: 20KB - Virtual size: 18KB

.text
Size: 320KB - Virtual size: 316KB

.rdata
Size: 40KB - Virtual size: 37KB

.data
Size: 28KB - Virtual size: 42KB

.rsrc
Size: 104KB - Virtual size: 103KB

.reloc
Size: 20KB - Virtual size: 18KB