310267b8f325abc5fba395cc7b892d3e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

310267b8f325abc5fba395cc7b892d3e_JaffaCakes118
Size

419KB
MD5

310267b8f325abc5fba395cc7b892d3e
SHA1

073b0144757e2b71ff9e7adfab3139d7b5df9ed5
SHA256

f8120a5c1ae9a255972d7bdd749249a3c7fbaa04c537314cbf53408d5babe918
SHA512

3d1afd990edc292ba004d4f83c827fae690645893a6c837b70eb4346bffbfdcc9d16bb44407ec40042dfda03062fbaa1291688ec6b2247d43934155122396ad9
SSDEEP

6144:OrH0Mt7IZ+27rQizgMlujXhV+CxL2i3tPK598SK7:7MdI8OrQiSjxK+t6K7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
310267b8f325abc5fba395cc7b892d3e_JaffaCakes118

Files

310267b8f325abc5fba395cc7b892d3e_JaffaCakes118
.dll windows:4 windows x86 arch:x86

c8b7248c83ac933892d545ece20ff378

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

iphlpapi

GetAdaptersInfo

kernel32

InterlockedIncrement
GetWindowsDirectoryW
FindFirstFileW
InterlockedDecrement
GetModuleFileNameW
GetLastError
DeleteCriticalSection
FindResourceW
Sleep
GetPrivateProfileIntW
GetPrivateProfileStringW
GetTempPathW
GetTempFileNameW
CreateProcessW
SetLastError
CreateMutexW
WriteProcessMemory
GetCurrentProcess
lstrlenW
GlobalAlloc
GetTickCount
GetModuleHandleW
GetShortPathNameA
GlobalLock
GlobalUnlock
FlushInstructionCache
MulDiv
EnterCriticalSection
LeaveCriticalSection
lstrcmpW
WideCharToMultiByte
CreateFileW
DeviceIoControl
VirtualQuery
VirtualProtect
VirtualAlloc
InterlockedCompareExchange
ResumeThread
GetThreadContext
SetThreadContext
SuspendThread
CompareStringW
CompareStringA
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
MultiByteToWideChar
GetConsoleCP
SetFilePointer
RtlUnwind
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetTimeZoneInformation
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetModuleFileNameA
GetStdHandle
WriteFile
HeapCreate
ExitProcess
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
IsValidCodePage
GetOEMCP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCommandLineA
GetSystemTimeAsFileTime
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
FindClose
FindNextFileW
DeleteFileW
WaitForSingleObject
CloseHandle
CreateThread
CreateEventW
GetCurrentProcessId
RaiseException
InitializeCriticalSection
FindResourceExW
SetEvent
LoadResource
LockResource
SizeofResource
GlobalFree
ReadFile
lstrcpyW
GetCurrentThreadId
FreeLibrary
GetCurrentThread
GetProcAddress
LoadLibraryW
SetEnvironmentVariableA
GetConsoleMode

user32

FindWindowW
SetWindowsHookExW
UnhookWindowsHookEx
SendMessageW
RegisterWindowMessageW
PostThreadMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
ShowWindow
CreateDialogParamW
DefWindowProcW
GetWindowThreadProcessId
GetClassInfoExW
RedrawWindow
IsChild
DestroyAcceleratorTable
CharNextW
ReleaseDC
ReleaseCapture
GetSysColor
SetCapture
GetDC
CreateWindowExW
FillRect
CallWindowProcW
MoveWindow
GetWindowTextLengthW
GetDlgItem
CallNextHookEx
SetTimer
KillTimer
GetDesktopWindow
UnregisterClassA
GetClientRect
GetWindowRect
SetWindowPos
SetWindowTextW
GetWindowLongW
SetWindowLongW
SetWindowPlacement
BeginPaint
EndPaint
DestroyWindow
ScreenToClient
EnumChildWindows
GetClassNameW
ClientToScreen
GetFocus
CreateAcceleratorTableW
SetFocus
GetWindow
InvalidateRgn
RegisterClassExW
InvalidateRect
GetWindowTextW
LoadCursorW
GetSystemMetrics
VkKeyScanW
PostMessageW
InflateRect
SetRect
PtInRect
GetCursorPos
OffsetRect
GetParent
IsWindow

gdi32

BitBlt
GetDeviceCaps
GetObjectW
CreateSolidBrush
GetStockObject
DeleteObject
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC

advapi32

RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
GetUserNameA
CloseServiceHandle
QueryServiceStatus
StartServiceW
ChangeServiceConfigW
OpenServiceA
RegQueryInfoKeyW
RegEnumValueW
RegOpenKeyExW
RegCloseKey
OpenSCManagerW

shell32

SHGetPathFromIDListW
SHGetFolderLocation
ShellExecuteW

ole32

CLSIDFromProgID
CoUninitialize
CoTaskMemAlloc
OleInitialize
StringFromGUID2
StringFromCLSID
CLSIDFromString
OleUninitialize
CoCreateInstance
OleLockRunning
CoGetClassObject
CreateStreamOnHGlobal
CoTaskMemFree
CoInitialize

oleaut32

SysStringLen
VariantCopy
SafeArrayUnaccessData
SafeArrayAccessData
SysFreeString
VariantClear
SysAllocStringLen
VariantInit
SysAllocString
LoadRegTypeLi
LoadTypeLi
SysStringByteLen
SafeArrayGetLBound
OleCreateFontIndirect
SafeArrayGetUBound
DispCallFunc

shlwapi

PathFindOnPathW
PathFileExistsW
PathIsRelativeW
PathFindFileNameW
PathFindExtensionW
StrStrIW
UrlCanonicalizeW

urlmon

CoInternetGetSession
URLDownloadToFileW
URLDownloadToCacheFileW

wininet

InternetCloseHandle
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
FindCloseUrlCache
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
InternetCanonicalizeUrlW
InternetCrackUrlW

Exports

Exports

CloseExistedDll
CloseExistedDllByRundll32
CreateTask
Invoke
SendStatisticDataOnInstall
UpdateIFEOInfo
fnClose
fnOpen

Sections

.text
Size: 202KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 38KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

oc5lvi6b
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

h58wbbvn
Size: 127KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

dzzn4f8g
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c8b7248c83ac933892d545ece20ff378

Headers

File Characteristics

Imports

iphlpapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

urlmon

wininet

Exports

Exports

Sections

.text Size: 202KB - Virtual size: 204KB

.rdata Size: 38KB - Virtual size: 40KB

.data Size: 11KB - Virtual size: 20KB

Shared Size: 512B - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 4KB

oc5lvi6b Size: 18KB - Virtual size: 20KB

h58wbbvn Size: 127KB - Virtual size: 128KB

dzzn4f8g Size: 20KB - Virtual size: 20KB

.text
Size: 202KB - Virtual size: 204KB

.rdata
Size: 38KB - Virtual size: 40KB

.data
Size: 11KB - Virtual size: 20KB

Shared
Size: 512B - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 4KB

oc5lvi6b
Size: 18KB - Virtual size: 20KB

h58wbbvn
Size: 127KB - Virtual size: 128KB

dzzn4f8g
Size: 20KB - Virtual size: 20KB