2ae7c94c910b011a6eefa91e6b3c1183_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

2ae7c94c910b011a6eefa91e6b3c1183_JaffaCakes118
Size

76KB
MD5

2ae7c94c910b011a6eefa91e6b3c1183
SHA1

9b4aa7a7980cec29a8cfbc56dbca80ede0a09cb6
SHA256

0bfd063cc1607ad11fdf9b12b30bdf3e2e105842b25c89007225314755c15cff
SHA512

fee894c79079beb9ac4350fb1879759ff564e5b7d355872cf9d6a73cec50828577c1606414461baecf91ce17f3bf7a12a4ce4ce1c8c9227490aae8ce623ae2df
SSDEEP

1536:kEDuON9p7H+GDOemZ8F6M8/QP+s5IOeFnToIf1OxczY6SuOD6:k+5eGuv/QmsTetTBfEuzY6SuOD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ae7c94c910b011a6eefa91e6b3c1183_JaffaCakes118

Files

2ae7c94c910b011a6eefa91e6b3c1183_JaffaCakes118
.dll windows:4 windows x86 arch:x86

66e94aae561a702d611ebb9ecd11b7af

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

PostMessageA
OpenDesktopA
GetThreadDesktop
OpenWindowStationA
OpenInputDesktop
wsprintfA
CloseWindow
CreateWindowExA
IsWindow
GetUserObjectInformationA
GetDesktopWindow
GetDC
ExitWindowsEx
GetWindowTextA
GetProcessWindowStation
GetKeyNameTextA
CallNextHookEx
GetActiveWindow
UnhookWindowsHookEx
SendMessageA
SetWindowsHookExA
keybd_event
MapVirtualKeyA
SystemParametersInfoA
WindowFromPoint
SetThreadDesktop
CloseDesktop
IsWindowVisible
CloseWindowStation
SetProcessWindowStation
GetWindowThreadProcessId
EnumWindows
GetCursorPos
ReleaseDC
SetCursorPos
SetCapture
GetSystemMetrics
SetRect
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
mouse_event

kernel32

Sleep
CloseHandle
OpenEventA
SetErrorMode
CreateMutexA
GetTickCount
lstrcpyA
SetUnhandledExceptionFilter
FreeConsole
lstrcpynA
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
DeleteFileA
CreateProcessA
lstrcatA
ReleaseMutex
WaitForSingleObject
lstrlenA
GetVolumeInformationA
GetLogicalDriveStringsA
FindClose
LocalFree
FindNextFileA
LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
GetFileSize
CreateFileA
ReadFile
SetFilePointer
FreeLibrary
GetProcAddress
GetDiskFreeSpaceExA
WriteFile
MoveFileA
CreateThread
LoadLibraryA
MoveFileExA
GetSystemDirectoryA
GlobalMemoryStatus
GetComputerNameA
GetVersionExA
GetLocalTime
GetFileAttributesA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
HeapFree
GetProcessHeap
HeapAlloc
SetEvent
InterlockedExchange
GetModuleHandleA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetLastError
SetLastError
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
TerminateProcess
PeekNamedPipe
WaitForMultipleObjects
ResetEvent
CancelIo
OpenProcess
Process32Next
LocalSize
Process32First
CreateToolhelp32Snapshot
TerminateThread
GetDiskFreeSpaceA
lstrcmpiA
GetCurrentThreadId
GetTempPathA
GetCurrentProcess
CreateEventA
GetDriveTypeA
GetSystemInfo

msvcrt

strstr
printf
strrchr
strcmp
_ftol
strcpy
??2@YAPAXI@Z
_except_handler3
_CxxThrowException
sprintf
strcat
memcpy
ceil
atoi
strtok
fclose
fread
fopen
__dllonexit
_onexit
??1type_info@@UAE@XZ
free
_initterm
memmove
_adjust_fdiv
wcstombs
??3@YAXPAX@Z
strncpy
memcmp
_beginthreadex
malloc
_EH_prolog
strlen
memset
__CxxFrameHandler

msvcp60

?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

shell32

SHGetFileInfoA

shlwapi

SHDeleteKeyA

imm32

ImmReleaseContext
ImmGetCompositionStringA
ImmGetContext

gdi32

GetPaletteEntries
CreateHalftonePalette
SelectObject
BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC
CreateDIBSection

ws2_32

WSACleanup
WSAGetLastError
WSAStartup
send
gethostname
socket
select
recv
gethostbyname
htons
inet_addr
setsockopt
connect
closesocket
getsockname

psapi

GetModuleFileNameExA
EnumProcessModules

avicap32

capCreateCaptureWindowA
capGetDriverDescriptionA

urlmon

URLDownloadToFileA

advapi32

InitializeSecurityDescriptor
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenEventLogA
ClearEventLogA
CloseEventLog
OpenProcessToken
GetTokenInformation
LookupAccountSidA
RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
RegSetValueExA
QueryServiceStatus
DeleteService
SetServiceStatus
ControlService
OpenSCManagerA
OpenServiceA
CloseServiceHandle
SetSecurityDescriptorDacl
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
RegisterServiceCtrlHandlerA
FreeSid
RegOpenKeyExA
RegQueryValueA
RegCloseKey

wtsapi32

WTSQuerySessionInformationA
WTSFreeMemory

Exports

Exports

ServiceMain

Sections

.text
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

66e94aae561a702d611ebb9ecd11b7af

Headers

File Characteristics

Imports

user32

kernel32

msvcrt

msvcp60

shell32

shlwapi

imm32

gdi32

ws2_32

psapi

avicap32

urlmon

advapi32

wtsapi32

Exports

Exports

Sections

.text Size: 47KB - Virtual size: 46KB

.rdata Size: 22KB - Virtual size: 21KB

.data Size: 3KB - Virtual size: 3KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 47KB - Virtual size: 46KB

.rdata
Size: 22KB - Virtual size: 21KB

.data
Size: 3KB - Virtual size: 3KB

.reloc
Size: 3KB - Virtual size: 3KB