30fc4f525fd1aee77d85994d58ae3768_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

30fc4f525fd1aee77d85994d58ae3768_JaffaCakes118
Size

173KB
MD5

30fc4f525fd1aee77d85994d58ae3768
SHA1

8fd4281a01199b8151303bcca0a2b2e1f10dbac3
SHA256

694072660a063231a59a71aa32518529bf43645523f6d66fc332f3afb6dcf413
SHA512

8f92044a1f2279e0de84058da912b21ec0856f3b4e9ddfedc3e76419629ffc85a14e9a22dca1933a2c391e3f21ac2e0bd4bec67866a153b5ef596276630dd140
SSDEEP

3072:a6cVm8/pIYTo7CT5R9OVZMJhha0ufXo46JWBG8ErgmTc+gTVhafFQEb:a63Kev7uRwyEfwJWsVTc+gT7gFQEb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
30fc4f525fd1aee77d85994d58ae3768_JaffaCakes118

Files

30fc4f525fd1aee77d85994d58ae3768_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

b8c67b0ed3979f1acce87e5cc9381bc0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

InternetCloseHandle
InternetOpenW
InternetCrackUrlW
InternetReadFile
InternetSetCookieExW
HttpOpenRequestW
HttpSendRequestW
InternetConnectW

shlwapi

StrStrW
StrChrW

kernel32

ExitProcess
GetWindowsDirectoryW
GetModuleHandleA
GetSystemInfo
GetProcAddress
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
CloseHandle
GetCurrentProcessId
VirtualQuery
WriteProcessMemory
GetCurrentProcess
VirtualProtect
lstrcmpiA
LoadLibraryA
LoadLibraryW
LoadLibraryExA
LoadLibraryExW
CreateSemaphoreW
OpenSemaphoreW
ResetEvent
CreateEventW
GetCurrentThreadId
SetEvent
CreateThread
lstrlenW
ReleaseSemaphore
WaitForSingleObject
MultiByteToWideChar
lstrlenA
GetLocalTime
Sleep
WaitForMultipleObjects
DisableThreadLibraryCalls
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
DeleteCriticalSection
GetShortPathNameW
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
lstrcpyW
lstrcatW
InterlockedDecrement
InterlockedIncrement
FlushInstructionCache
CancelWaitableTimer
OpenWaitableTimerW
SetWaitableTimer
CreateWaitableTimerW
GetLastError
OpenEventW
lstrcpynW
lstrcmpW
GetComputerNameW
WideCharToMultiByte
GetVersionExW
GetLocaleInfoW
lstrcpyA
LocalFree
LocalAlloc
FormatMessageW
CreateFileW
ReadFile
GetFileSize

user32

wsprintfA
CharNextW
wsprintfW

advapi32

RegEnumValueW
RegQueryInfoKeyW
RegDeleteKeyW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW

ole32

CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreateVector
VariantInit
SysAllocStringLen
LoadRegTypeLi
DispCallFunc
RegisterTypeLi
LoadTypeLi
SysStringLen
VariantClear
SysAllocString
SysFreeString

imagehlp

ImageDirectoryEntryToData

msvcp60

?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD0@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

msvcrt

??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
strchr
free
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler3
??0exception@@QAE@ABV0@@Z
_initterm
malloc
time
fopen
fprintf
fclose
??2@YAPAXI@Z
__CxxFrameHandler
strtol
memset
strlen
_CxxThrowException
memcpy
memcmp
atoi
printf
_purecall
?terminate@@YAXXZ
_adjust_fdiv

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b8c67b0ed3979f1acce87e5cc9381bc0

Headers

File Characteristics

Imports

wininet

shlwapi

kernel32

user32

advapi32

ole32

oleaut32

imagehlp

msvcp60

msvcrt

Exports

Exports

Sections

.text Size: 118KB - Virtual size: 117KB

.rdata Size: 35KB - Virtual size: 34KB

.data Size: 6KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 118KB - Virtual size: 117KB

.rdata
Size: 35KB - Virtual size: 34KB

.data
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 9KB - Virtual size: 8KB