2c2ed799bbc62769a8a731bc91530b8d_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

2c2ed799bbc62769a8a731bc91530b8d_JaffaCakes118
Size

460KB
MD5

2c2ed799bbc62769a8a731bc91530b8d
SHA1

2414d1c41fc0e3d92f546e42f1c74d4d176d7d7a
SHA256

d55157b4d3e2d8d14f26b1de4df2f06950ff45de79529e6d2734299e6de05b0d
SHA512

20bddd2ea76c5cdec3c7be72588b2c63a45dc98d8f3c762ee6033886cf3314bcdf1d8b562df72252615fdec7edd2531327a0234f23c7e991d2463e3f232a3542
SSDEEP

6144:Bhxw6MlOuA4SvjrH6PSU6QA6V0zZu/YFC8BZKxveVXJTpMYaGFkGz5Zz8:BEbQtrH6PSUb0zZu/gBZKgZJ6YFZj8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2c2ed799bbc62769a8a731bc91530b8d_JaffaCakes118

Files

2c2ed799bbc62769a8a731bc91530b8d_JaffaCakes118
.dll regsvr32 windows:6 windows x86 arch:x86

19a025e2f9ba983b1692d882e51d41e6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MSNLNamespaceMgr.pdb

Imports

msvcrt

strncmp
wcsstr
wcsrchr
wcspbrk
_vscwprintf
_mbsicmp
_mbsstr
_isatty
_write
_lseeki64
_fileno
__pioinfo
__badioinfo
ferror
wctomb
_itoa
_snprintf
_iob
_purecall
__mb_cur_max
mbtowc
isdigit
memmove
_onexit
_lock
__dllonexit
_unlock
realloc
??1type_info@@UAE@XZ
_adjust_fdiv
_amsg_exit
_initterm
_XcptFilter
_callnewh
??0exception@@QAE@ABV0@@Z
_mbschr
calloc
_wcsicmp
memset
malloc
_CxxThrowException
free
isleadbyte
_vsnwprintf
wcsncmp
_wcsnicmp
bsearch
iswspace
wcsspn
wcscspn
_strnicmp
strtoul
isalpha
_mbsinc
_mbspbrk
_vscprintf
wcstoul
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@XZ
_wcslwr
_strlwr
_errno
_mbslwr
__CxxFrameHandler
wcschr
_wfopen
fread
fclose
_wtol
memcpy

advapi32

RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyW
RegEnumValueW
RegOpenKeyW

kernel32

Sleep
GlobalReAlloc
CompareFileTime
GetACP
SearchPathW
GetSystemDefaultUILanguage
UnmapViewOfFile
GetVersionExW
GetLocaleInfoW
CreateFileMappingW
MapViewOfFile
lstrcmpW
GetUserDefaultUILanguage
LoadLibraryW
SetLastError
GetProcAddress
InterlockedCompareExchange
OutputDebugStringA
RtlUnwind
InterlockedExchange
GetProcessHeap
QueryPerformanceCounter
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
GetFileAttributesExW
GetUserDefaultLCID
ReadFile
CopyFileW
FindFirstFileW
FindNextFileW
FindClose
GetTempPathW
CreateFileW
DeleteFileW
GetTickCount
lstrlenA
WriteFile
WideCharToMultiByte
GlobalAlloc
GlobalFree
CloseHandle
FindResourceExW
LockResource
LocalFree
GetThreadLocale
SetThreadLocale
GetModuleHandleW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
CompareStringW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapSize
lstrlenW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
lstrcmpiW
GetModuleFileNameW
InterlockedIncrement
InterlockedDecrement
FreeLibrary

ole32

CLSIDFromString
StgOpenStorage
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoCreateInstance
CreateStreamOnHGlobal
CLSIDFromProgID
StringFromCLSID
GetRunningObjectTable
CreateBindCtx

oleaut32

VarUI4FromStr
VariantCopy
VariantInit
VariantClear
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayCreateVector
SysStringByteLen
VariantChangeType
GetErrorInfo
CreateErrorInfo
SysStringLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
SysAllocStringByteLen
VarBstrCmp
SysAllocStringLen
SysFreeString

shell32

SHGetMalloc
SHParseDisplayName
SHFileOperationW
SHGetFolderLocation
SHGetPathFromIDListW
SHGetDesktopFolder
SHBindToParent

shlwapi

PathFindFileNameW
PathIsURLW
UrlGetPartW
PathFileExistsW
PathRemoveFileSpecW
PathCombineW
StrCmpIW
StrCmpNIA
PathRenameExtensionW
PathFindExtensionW
PathAppendW
PathIsFileSpecW
PathRemoveExtensionW
PathIsDirectoryW
UrlCreateFromPathW
PathRemoveBackslashW
PathIsRootW
ord487
StrCmpNIW
PathIsUNCW

user32

LoadMenuW
LoadStringW
LoadImageW
UnregisterClassA
CharNextW

urlmon

URLOpenBlockingStreamW

wininet

CommitUrlCacheEntryW
RetrieveUrlCacheEntryFileW
CreateUrlCacheEntryW
DeleteUrlCacheEntryW
UnlockUrlCacheEntryFileW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 202KB - Virtual size: 202KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

19a025e2f9ba983b1692d882e51d41e6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

ole32

oleaut32

shell32

shlwapi

user32

urlmon

wininet

Exports

Exports

Sections

.text Size: 202KB - Virtual size: 202KB

.data Size: 1KB - Virtual size: 2KB

.rsrc Size: 79KB - Virtual size: 79KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: 202KB - Virtual size: 202KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 79KB - Virtual size: 79KB

.reloc
Size: 12KB - Virtual size: 12KB