2f94a8cee9664e628a32f907bf993d76_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2f94a8cee9664e628a32f907bf993d76_JaffaCakes118
Size

360KB
MD5

2f94a8cee9664e628a32f907bf993d76
SHA1

81e93d3af84a09799d32561aad4f7ee803632a8e
SHA256

56b7ba89f28e658ebfd73fafbcee373ea8ef6c3368a64b2a6b04b017dbc1695b
SHA512

fe59f26d6711e1307e0a7817483edd0d758aac5b3b7c31815aa124442b7ce57e9327712525a1599becf79f742c84001bb7fdbd2403a4b49beef72248a5e5e63e
SSDEEP

6144:fPYQGuLzjip7jc/W1ns16Yjgc6Wm/yXL8BPvuKqHe31xW6tgsov69u2WHnF9p:nLFzUwPXL8RvuKqs146bQ2K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f94a8cee9664e628a32f907bf993d76_JaffaCakes118

Files

2f94a8cee9664e628a32f907bf993d76_JaffaCakes118
.dll windows:4 windows x86 arch:x86

70a7fa2476f44aba60eef8cc85785f7e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord861
ord833
ord2814
ord3876
ord6069
ord2117
ord6000
ord6067
ord5655
ord6334
ord3092
ord2642
ord6199
ord2302
ord2370
ord2289
ord529
ord656
ord796
ord4853
ord4376
ord3610
ord6662
ord926
ord500
ord2086
ord5860
ord6142
ord772
ord2763
ord4277
ord6283
ord541
ord801
ord6929
ord758
ord475
ord4710
ord4234
ord641
ord324
ord3597
ord4425
ord5280
ord1775
ord6052
ord2514
ord4998
ord5265
ord6453
ord1146
ord2859
ord3571
ord2820
ord6383
ord5440
ord6215
ord4299
ord5787
ord3573
ord2379
ord6380
ord6197
ord562
ord816
ord5875
ord5789
ord3626
ord3619
ord4275
ord1949
ord2107
ord2044
ord2448
ord2841
ord6394
ord5834
ord5450
ord3663
ord536
ord2781
ord4058
ord3178
ord941
ord4278
ord5856
ord4129
ord567
ord1233
ord6442
ord818
ord3742
ord4627
ord3402
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1776
ord4078
ord6055
ord5858
ord6140
ord654
ord341
ord2256
ord1200
ord2726
ord2614
ord924
ord565
ord817
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5715
ord5289
ord5307
ord4699
ord4079
ord5303
ord5300
ord3346
ord2396
ord4226
ord1948
ord5572
ord2764
ord6877
ord4202
ord5683
ord5710
ord2860
ord323
ord1640
ord5785
ord2405
ord2414
ord1168
ord640
ord6385
ord3318
ord1641
ord289
ord613
ord2915
ord858
ord939
ord1187
ord533
ord5194
ord3811
ord3337
ord2818
ord6407
ord1997
ord798
ord540
ord860
ord535
ord537
ord356
ord2770
ord1980
ord668
ord800
ord1575
ord1182
ord342
ord1253
ord354
ord5186
ord665
ord5773
ord5442
ord1979
ord823
ord825

msvcrt

_except_handler3
memmove
_vsnprintf
sprintf
wcscmp
strrchr
_strlwr
_mbscmp
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
atoi
strncpy
strncmp
exit
__CxxFrameHandler
memcpy
memset
_callnewh
strcat
strlen
printf
time
rand
srand
_CxxThrowException
strcmp
strcpy
fprintf
_iob
free
calloc
malloc
realloc
memcmp
??0exception@@QAE@ABV0@@Z
_ftol
abs
_purecall
system
_flushall
getenv
strstr
wcstombs
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
_onexit
__dllonexit
_CIpow
_CIacos
wcsstr
_mbsicmp
sscanf
_strupr

kernel32

TerminateProcess
GetConsoleScreenBufferInfo
ReadConsoleOutputA
ReadConsoleOutputCharacterA
GetStdHandle
WriteConsoleInputA
TerminateThread
MoveFileA
SetFileAttributesA
DeleteFileA
WinExec
GlobalFree
GetTickCount
GlobalLock
GlobalAlloc
GlobalUnlock
GlobalReAlloc
CreateEventA
WaitForSingleObject
SetEvent
GetSystemDirectoryA
CreateProcessA
FormatMessageA
lstrlenA
LocalFree
OutputDebugStringA
Sleep
GetCommandLineA
SetUnhandledExceptionFilter
GetModuleFileNameA
GetCurrentProcess
GetModuleHandleA
GetProcAddress
CreateThread
GetCurrentThreadId
GetCurrentProcessId
Thread32First
OpenThread
Thread32Next
CreateToolhelp32Snapshot
Module32First
LoadLibraryA
FreeLibrary
Module32Next
CloseHandle
CopyFileA
SetCurrentDirectoryA
AllocConsole
FreeConsole
WriteFile
LeaveCriticalSection
EnterCriticalSection
ReadFile
OpenProcess
DeleteCriticalSection
WaitForMultipleObjectsEx
InitializeCriticalSection
SetStdHandle
CreatePipe
Process32Next
Process32First
GetVersionExA
GetWindowsDirectoryA
LocalAlloc
WideCharToMultiByte
GetDiskFreeSpaceExA
lstrcpyA
GetDriveTypeA
FindClose
FindNextFileA
FindFirstFileA
lstrcatA
GetFileSize
CreateFileA
SetFilePointer
CreateDirectoryA
RemoveDirectoryA
GetStartupInfoA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetExitCodeProcess
GetTempPathA
GetVersion
lstrcpynA
lstrcmpA
MapViewOfFile
UnmapViewOfFile
DuplicateHandle
GetLocalTime
VirtualFreeEx
ReadProcessMemory
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
lstrlenW
GetExitCodeThread
SetLastError
MultiByteToWideChar
VirtualQueryEx
GetSystemInfo
HeapFree
HeapAlloc
GetProcessHeap
GetEnvironmentVariableW
QueryPerformanceFrequency
QueryPerformanceCounter
InterlockedDecrement
GetVolumeInformationA
GetComputerNameA
lstrcmpiA
GetLogicalDrives
GlobalMemoryStatus
Beep
GetPrivateProfileStringA
ExitThread
ExitProcess
CreateMutexA
GetLastError
DeviceIoControl

user32

GetDCEx
KillTimer
EndDialog
SetTimer
SetForegroundWindow
SetWindowPos
DialogBoxParamA
EnumChildWindows
RegisterWindowMessageA
GetAsyncKeyState
GetKeyState
GetFocus
GetKeyNameTextA
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
GetForegroundWindow
InternalGetWindowText
GetWindowTextA
GetWindowThreadProcessId
ShowWindow
LoadBitmapA
SetRect
CopyRect
UnregisterHotKey
SetCursorPos
GetWindowPlacement
GetTopWindow
GetWindowLongA
RegisterHotKey
IsWindowUnicode
SendMessageTimeoutA
GetWindow
EnumWindows
CharToOemA
EnumDisplayDevicesA
IsWindowVisible
GetSystemMetrics
GetWindowDC
GetWindowRect
GetDC
ReleaseDC
GetDesktopWindow
SwapMouseButton
ScreenToClient
wsprintfA
IsCharAlphaNumericA
GetCursorPos
FillRect
InvalidateRect
SetWindowRgn
SetWindowLongA
DefWindowProcA
LoadIconA
RegisterClassA
GetMessageA
TranslateMessage
DispatchMessageA
GetClientRect
LoadCursorA
SendMessageA
CloseWindow
CreateWindowExA
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation
CloseWindowStation
OpenInputDesktop
GetUserObjectInformationA
SetThreadDesktop
GetThreadDesktop
OpenDesktopA
CloseDesktop
GetClassNameA
PostMessageA
GetCursor
IsRectEmpty
PostThreadMessageA
WindowFromPoint
PostQuitMessage
GetIconInfo
DestroyIcon
OpenClipboard
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
ExitWindowsEx
SystemParametersInfoA
EnableWindow
keybd_event
mouse_event
MessageBoxA

gdi32

CreateDIBSection
BitBlt
DeleteObject
GetObjectA
CreateCompatibleDC
SelectObject
GetDIBits
DeleteDC
CreateBitmap
CreatePatternBrush
PatBlt
ExtCreateRegion
CombineRgn
CreateSolidBrush
CreateFontIndirectA
BeginPath
EndPath
PathToRegion
GetDeviceCaps
GetBitmapBits
CreateDCA
GetPixel
GetStockObject
SelectPalette
RealizePalette
CreateCompatibleBitmap

advapi32

GetSecurityDescriptorDacl
ReportEventA
RegisterEventSourceA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RevertToSelf
BuildTrusteeWithSidA
AllocateAndInitializeSid
FreeSid
SetKernelObjectSecurity
SetSecurityDescriptorDacl
MakeAbsoluteSD
GetSecurityInfo
RegEnumKeyA
RegEnumValueA
RegOpenKeyA
RegCreateKeyA
RegSetValueExA
GetUserNameA
SetSecurityInfo
RegEnumKeyExA
RegDeleteValueA
EnumServicesStatusA
DeleteService
ChangeServiceConfigA
ControlService
StartServiceA
OpenSCManagerA
CloseServiceHandle
OpenServiceA
QueryServiceConfigA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
CreateProcessAsUserA
DuplicateTokenEx
ImpersonateLoggedOnUser
GetKernelObjectSecurity
SetEntriesInAclA
DeregisterEventSource

shell32

SHGetSpecialFolderPathA
ShellExecuteA
SHGetFileInfoA
ExtractIconExA

ole32

CreateStreamOnHGlobal
CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
CoInitializeSecurity
CoTaskMemFree
CoInitialize

olepro32

ord251

oleaut32

VariantChangeType
VariantInit
SysAllocString
VariantClear
SysFreeString
GetErrorInfo

urlmon

URLDownloadToFileA

msvcp60

??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADHD@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?nothrow@std@@3Unothrow_t@1@B
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

wininet

InternetCheckConnectionA
InternetGetConnectedState
HttpQueryInfoA
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle

msvfw32

ICInfo
ICGetInfo
ICSeqCompressFrameStart
ICSendMessage
ICOpen
ICClose
ICSeqCompressFrame
ICCompressorFree
ICSeqCompressFrameEnd

shlwapi

SHDeleteValueA
SHDeleteKeyA

imm32

ImmGetContext
ImmGetCompositionStringA
ImmReleaseContext

ntdll

ZwOpenSection
RtlInitUnicodeString
ZwOpenFile
ZwQuerySystemInformation
_strnicmp
_stricmp
_strcmpi
_wcsicmp
wcslen

winmm

mciSendStringA
waveOutGetNumDevs
waveOutGetDevCapsA
mixerGetID
mixerOpen
mixerGetLineInfoA
mixerGetLineControlsA
mixerGetControlDetailsA
mixerSetControlDetails
mixerClose
sndPlaySoundA
timeGetTime
waveInUnprepareHeader
waveInStop
waveInReset
waveInClose
waveInGetErrorTextA
waveOutSetVolume
waveOutOpen
waveOutGetErrorTextA
waveOutClose
waveOutReset
waveOutUnprepareHeader
waveOutWrite
waveOutPrepareHeader
waveInStart
waveInAddBuffer
waveInPrepareHeader
waveInOpen

ws2_32

listen
inet_ntoa
WSAAsyncSelect
setsockopt
socket
__WSAFDIsSet
gethostname
WSACleanup
WSAStartup
recv
send
WSARecv
WSASend
recvfrom
getpeername
WSAAsyncGetHostByName
sendto
getsockname
ntohs
WSACloseEvent
WSACreateEvent
WSASocketA
bind
htonl
htons
accept
select
ioctlsocket
connect
gethostbyname
inet_addr
WSAGetLastError
closesocket
WSAGetOverlappedResult
WSAResetEvent
WSAWaitForMultipleEvents
WSAConnect

iphlpapi

GetAdaptersInfo

Exports

Exports

start
test

Sections

.text
Size: 208KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

70a7fa2476f44aba60eef8cc85785f7e

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ole32

olepro32

oleaut32

urlmon

msvcp60

wininet

msvfw32

shlwapi

imm32

ntdll

winmm

ws2_32

iphlpapi

Exports

Exports

Sections

.text Size: 208KB - Virtual size: 204KB

.rdata Size: 56KB - Virtual size: 54KB

.data Size: 56KB - Virtual size: 2.6MB

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 32KB - Virtual size: 31KB

.text
Size: 208KB - Virtual size: 204KB

.rdata
Size: 56KB - Virtual size: 54KB

.data
Size: 56KB - Virtual size: 2.6MB

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 32KB - Virtual size: 31KB