323e0d59194fd0a6e08c2f8459636da2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

323e0d59194fd0a6e08c2f8459636da2_JaffaCakes118
Size

134KB
MD5

323e0d59194fd0a6e08c2f8459636da2
SHA1

f92b9308cb5e95c319eca55640d14f40f689e111
SHA256

42c7c06ae75085a92ed25ce4b4c9fa9a5ff43a589e07dcd86e7292969a403d07
SHA512

57f8fd3415cac0b13fe823f000e76bada9161c62aa3e07546ba5dce97269b800e9647a8dbb03fb635a85ae79212da123f7926d70435b5594da641139febe456a
SSDEEP

3072:fg15YHk8ggd0WNqT9nWo3skWh5HTtgpLcSS/lHNYuOvNRaI1bfO1puomMJ09mG72:fh2LK9+zKI1zO1puLC8i

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
323e0d59194fd0a6e08c2f8459636da2_JaffaCakes118

Files

323e0d59194fd0a6e08c2f8459636da2_JaffaCakes118
.dll windows:5 windows x86 arch:x86

656f364b6f9fbc8c91975d543f1f30c9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

SHDeleteKeyA

msvcr90

__CxxFrameHandler3
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
memset
_malloc_crt
strstr
ceil
memmove
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
free
malloc
strrchr
_strrev
_stricmp
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_strnicmp
_encode_pointer
_except_handler4_common
calloc
_snprintf
_beginthreadex
wcstombs
atol
strncat
strchr
sprintf
strncmp
atoi
realloc
??_U@YAPAXI@Z
fopen
fwrite
fclose
strncpy
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_invalid_parameter_noinfo

kernel32

GetFileAttributesA
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
lstrcmpA
GetPrivateProfileStringA
GetVersionExA
GetLastError
ResetEvent
lstrlenA
GetDiskFreeSpaceExA
FindClose
LocalFree
LocalReAlloc
LocalAlloc
GetFileSize
CreateFileA
WriteFile
MoveFileA
ReadFile
lstrcatA
SetFilePointer
GetModuleFileNameA
GetCurrentProcess
VirtualAllocEx
GetLocalTime
MoveFileExA
GetTickCount
HeapFree
HeapAlloc
GetProcessHeap
OutputDebugStringA
UnmapViewOfFile
InterlockedExchange
VirtualFree
VirtualAlloc
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
LocalSize
DisconnectNamedPipe
PeekNamedPipe
WaitForMultipleObjects
GetStartupInfoA
CreatePipe
GlobalMemoryStatusEx
DeviceIoControl
GetSystemInfo
GetModuleHandleA
ReleaseMutex
OpenEventA
SetErrorMode
CreateMutexA
SetUnhandledExceptionFilter
FreeConsole
CreateToolhelp32Snapshot
lstrcmpiA
GetCurrentThreadId
CreateRemoteThread
OpenProcess
Module32Next
Module32First
InterlockedCompareExchange
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
CancelIo
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObject
DeleteFileA
LoadLibraryA
GetProcAddress
lstrcpyA
CloseHandle
CreateEventA
CreateDirectoryA

user32

IsWindow
CloseWindow
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
ExitWindowsEx
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation
GetCursorPos
SetRect
GetDesktopWindow
GetDC
ReleaseDC
GetCursorInfo
GetSystemMetrics
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
mouse_event
SetCursorPos
SetCapture
MapVirtualKeyA
keybd_event
DestroyCursor
DispatchMessageA
TranslateMessage
GetMessageA
wsprintfA
CharNextA
MessageBoxA
SendMessageA
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
GetWindowTextA
GetForegroundWindow
GetAsyncKeyState
GetKeyState
GetActiveWindow
CallNextHookEx
UnhookWindowsHookEx
PostMessageA
PostQuitMessage
DefWindowProcA
UpdateWindow
ShowWindow
CreateWindowExA
RegisterClassA
WindowFromPoint
LoadIconA
LoadCursorA

gdi32

CreateCompatibleDC
CreateDIBSection
DeleteDC
GetDIBits
CreateCompatibleBitmap
BitBlt
SelectObject
GetStockObject
DeleteObject

advapi32

AbortSystemShutdownA
OpenEventLogA
ClearEventLogA
CloseEventLog
RegOpenKeyA
RegQueryValueExA
RegSetValueExA
StartServiceA
OpenSCManagerA
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
CloseServiceHandle
RegOpenKeyExA
RegQueryValueA
RegCloseKey
LsaFreeMemory
LsaOpenPolicy
LookupAccountNameA
IsValidSid
OpenProcessToken
CreateProcessAsUserA
SetTokenInformation
DuplicateTokenEx
SetServiceStatus
RegisterServiceCtrlHandlerA
LookupAccountSidA
GetTokenInformation
LockServiceDatabase
ChangeServiceConfigA
AdjustTokenPrivileges
LookupPrivilegeValueA
FreeSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
InitializeSecurityDescriptor
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
QueryServiceConfigA
EnumServicesStatusA
UnlockServiceDatabase

shell32

SHGetSpecialFolderPathA
SHGetFileInfoA

ws2_32

sendto
bind
inet_addr
WSAAsyncSelect
WSAConnect
inet_ntoa
socket
__WSAFDIsSet
connect
WSAIoctl
WSACleanup
setsockopt
ioctlsocket
gethostname
htonl
listen
accept
send
select
recv
closesocket
gethostbyname
ntohs
WSAStartup
WSAGetLastError
recvfrom
WSARecv
getpeername
WSAAsyncGetHostByName
htons
WSASend
getsockname

userenv

GetUserProfileDirectoryA
GetProfilesDirectoryA

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

psapi

GetModuleFileNameExA
EnumProcessModules

imm32

ImmGetCompositionStringA
ImmReleaseContext
ImmGetContext

wininet

InternetCloseHandle
InternetReadFile
InternetOpenUrlA
InternetOpenA

avicap32

capCreateCaptureWindowA
capGetDriverDescriptionA

msvfw32

ICSeqCompressFrameEnd
ICCompressorFree
ICClose
ICSeqCompressFrame
ICSendMessage
ICOpen
ICSeqCompressFrameStart

wtsapi32

WTSFreeMemory
WTSQueryUserToken
WTSQuerySessionInformationA

Exports

Exports

CodeMain
CodeService
MainCode
MainService
ServiceCode
ServiceMain
main

Sections

.text
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

656f364b6f9fbc8c91975d543f1f30c9

Headers

File Characteristics

Imports

shlwapi

msvcr90

kernel32

user32

gdi32

advapi32

shell32

ws2_32

userenv

msvcp90

psapi

imm32

wininet

avicap32

msvfw32

wtsapi32

Exports

Exports

Sections

.text Size: 94KB - Virtual size: 93KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 9KB - Virtual size: 23KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 94KB - Virtual size: 93KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 9KB - Virtual size: 23KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 7KB