2ed8a7fd7b8f23d253f5b5a3e70b66bc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2ed8a7fd7b8f23d253f5b5a3e70b66bc_JaffaCakes118
Size

264KB
MD5

2ed8a7fd7b8f23d253f5b5a3e70b66bc
SHA1

fdb91c67eb3564e060fd18061d824cebcaf292e9
SHA256

935dec5cbf859d81de7d105fab739d31e753d93ffe55e00c7aaa59a7108390d7
SHA512

ad6b01f0879a356e3ce73533c6dcdfadc4e3e0af514c40b6425727854a03d5f514f97c49adc34da16e27e486db6da89c74d5af36c104c7c4e8e88b7664b8d4d1
SSDEEP

6144:ZIBiDX4+0Ap26kTspiJx1bBDKXEqS3rEwIAONp2Q:ZI0Dtp2epebBWL+gwIAQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ed8a7fd7b8f23d253f5b5a3e70b66bc_JaffaCakes118

Files

2ed8a7fd7b8f23d253f5b5a3e70b66bc_JaffaCakes118
.dll windows:4 windows x86 arch:x86

fdec8dbf13a578669caef6abc52b0f84

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\MyData\from Tong\2008_8_7\BS_dll\Release\BsDll.pdb

Imports

kernel32

WaitForSingleObject
CreateProcessA
FileTimeToSystemTime
IsBadCodePtr
UnmapViewOfFile
MapViewOfFile
SetFileAttributesA
GetFileAttributesA
IsBadReadPtr
GetDriveTypeA
ReadFile
SetFilePointer
WriteFile
TerminateProcess
PeekNamedPipe
GetTempPathA
GetStartupInfoA
CreatePipe
GlobalAlloc
GetLastError
FreeLibraryAndExitThread
SetFileTime
GetFileTime
WinExec
Process32Next
Process32First
CreateToolhelp32Snapshot
GetFileInformationByHandle
SystemTimeToFileTime
lstrlenA
lstrcmpA
GetTickCount
OpenFileMappingA
CreateFileMappingA
CopyFileA
DeleteFileA
LoadLibraryA
Sleep
GetComputerNameA
CreateDirectoryA
DeviceIoControl
CloseHandle
GetModuleFileNameA
CreateThread
CreateFileA
GetFileSize
LockFile
GetWindowsDirectoryA
GetLocalTime
ExitThread
GetSystemDirectoryA
FindFirstFileA
FindNextFileA
OpenProcess
FindClose
GetDiskFreeSpaceA
GetVolumeInformationA
GetLocaleInfoW
HeapSize
RaiseException
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
CompareStringA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
SetUnhandledExceptionFilter
InitializeCriticalSection
FlushFileBuffers
InterlockedExchange
SetStdHandle
SetConsoleCtrlHandler
lstrcpyA
GetStringTypeW
GetStringTypeA
VirtualQuery
GetSystemInfo
VirtualProtect
GetTimeZoneInformation
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetCurrentProcess
GetCPInfo
GetOEMCP
GetACP
LCMapStringW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
GetFileType
GetStdHandle
SetHandleCount
GetModuleHandleA
GetProcAddress
ExitProcess
HeapAlloc
HeapFree
RtlUnwind
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetTimeFormatA
GetDateFormatA
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCurrentProcessId
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FatalAppExitA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
TlsAlloc
SetLastError
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue

user32

GetDesktopWindow

advapi32

CryptDecrypt
CryptAcquireContextA
CryptImportKey
CryptReleaseContext
CryptDestroyKey
CryptEncrypt
RegEnumKeyExA
OpenProcessToken
CreateProcessAsUserA
RegDeleteValueA
RegEnumValueA
StartServiceA
OpenSCManagerA
EnumServicesStatusExA
OpenServiceA
ControlService
RegQueryInfoKeyA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA

shlwapi

PathFileExistsA

wininet

HttpSendRequestExA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetCloseHandle
InternetConnectA
InternetOpenA
InternetGetConnectedState
DeleteUrlCacheEntry
HttpEndRequestA
InternetWriteFile

urlmon

URLDownloadToFileA

ws2_32

select
gethostbyname
inet_addr
connect
WSACleanup
WSAGetLastError
htons
setsockopt
listen
accept
recv
send
closesocket
WSAStartup
ioctlsocket
gethostname
getpeername
getsockname
__WSAFDIsSet
htonl
ntohl
ntohs
inet_ntoa
socket
bind

iphlpapi

GetTcpTable
GetAdaptersInfo
GetUdpTable

Sections

.text
Size: 192KB - Virtual size: 190KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.plugins
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fdec8dbf13a578669caef6abc52b0f84

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shlwapi

wininet

urlmon

ws2_32

iphlpapi

Sections

.text Size: 192KB - Virtual size: 190KB

.rdata Size: 40KB - Virtual size: 38KB

.data Size: 12KB - Virtual size: 19KB

.plugins Size: 4KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 8KB

.text
Size: 192KB - Virtual size: 190KB

.rdata
Size: 40KB - Virtual size: 38KB

.data
Size: 12KB - Virtual size: 19KB

.plugins
Size: 4KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 8KB