335b6f1572a65595c93209fa8b039520_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

335b6f1572a65595c93209fa8b039520_JaffaCakes118
Size

204KB
MD5

335b6f1572a65595c93209fa8b039520
SHA1

3f1948aaef042f5dc00fab1031db940f435e7e50
SHA256

f5ad02fc9f59f99a836811e2d8d03d6d1d3a3481197c2fcc92ba2df503aa715e
SHA512

3f9bf1169ea5ed65e8119e91143bc9965fd6e3b8d70fe0c245b3239feb64b493b80bf47414374505662fde6aac519313c0ff36e337f3b676b7b46004f47ba156
SSDEEP

3072:CE961nzKaNiIpJ03tmjCCSnkkUuMA7d9R4b+A8XRfv9gPbg8ffqLFPOD:CEg1zKa30dQCnnVUnAJ4Sv9gPELkD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
335b6f1572a65595c93209fa8b039520_JaffaCakes118

Files

335b6f1572a65595c93209fa8b039520_JaffaCakes118
.dll windows:4 windows x86 arch:x86

c95196ca470cca3e5e5786e7eea5e3c6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MulDiv
CloseHandle
WriteFile
CreateFileA
GetTempPathA
GetModuleFileNameA
lstrcpyA
lstrcpynA
CreateProcessA
lstrcatA
lstrcmpiA
OpenFile
GlobalFree
GlobalUnlock
GlobalHandle
GetLastError
SetEndOfFile
GetLocaleInfoW
GetLocaleInfoA
ReadFile
FlushFileBuffers
SetStdHandle
SetFilePointer
SizeofResource
FindResourceA
IsBadCodePtr
IsBadWritePtr
IsBadReadPtr
GetEnvironmentStringsW
HeapAlloc
FreeEnvironmentStringsW
ResetEvent
HeapFree
GetACP
GetCPInfo
GetStartupInfoA
InterlockedDecrement
GetStdHandle
SetHandleCount
LCMapStringW
LCMapStringA
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
SetUnhandledExceptionFilter
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
HeapSize
GetCurrentProcess
TerminateProcess
ExitProcess
lstrlenA
GetCurrentProcessId
GetProcessHeap
GetStringTypeA
GetStringTypeW
GetEnvironmentStrings
InterlockedExchange
SetEnvironmentVariableA
CompareStringW
GetTickCount
Sleep
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LoadLibraryA
GetProcAddress
GetFileType
CompareStringA
GetVersion
FreeLibrary
GetModuleHandleA
GetCommandLineA
WideCharToMultiByte
MultiByteToWideChar
GetLocalTime
GetSystemTime
GetTimeZoneInformation
HeapReAlloc
RaiseException
RtlUnwind
FreeEnvironmentStringsA
GetOEMCP

user32

CreateWindowExA
RegisterClassA
IsWindow
GetDlgItem
DestroyWindow
LoadStringA
DispatchMessageA
SetWindowTextA
SendMessageA
EndDialog
TranslateMessage
SetFocus
DialogBoxParamA
EnableWindow
GetDesktopWindow
SetWindowPos
GetFocus
GetWindowRect
LoadIconA
GetSystemMetrics
MessageBoxA
GetClientRect
ShowWindow
GetMessagePos
EndPaint
ScreenToClient
SetWindowLongA
GetWindowLongA
BeginPaint
SetCursor
GetSysColor
LoadCursorA
GetWindowTextA
DdeDisconnect
DdeUninitialize
DdeClientTransaction
wsprintfA
DdeFreeStringHandle
DdeCreateStringHandleA
DdeInitializeA
DdeConnect
DefWindowProcA
CallWindowProcA
UnregisterClassA

gdi32

SetTextColor
SetBkColor
GetDeviceCaps
CreateFontIndirectA
DeleteObject
CreateSolidBrush

comdlg32

GetSaveFileNameA
GetOpenFileNameA

advapi32

RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA

shell32

FindExecutableA

wsock32

WSAStartup
WSAGetLastError
inet_addr
sendto
recvfrom
setsockopt
closesocket
bind
connect
socket
inet_ntoa
htons
WSAAsyncSelect
htonl
ioctlsocket
WSAAsyncGetHostByName
WSASetLastError
gethostbyname
recv
send
WSACleanup

comctl32

ImageList_LoadImageA
PropertySheetA
ImageList_Destroy

Exports

Exports

Vcp_CheckAndDownload
Vcp_CreateDownloadClient
Vcp_CreateUpdateClient
Vcp_CreateUpdateClientWithPackage
Vcp_DestroyClient
Vcp_ProcessDownloadRequest
Vcp_ProcessUpdateRequest
Vcp_RspGetComponentDownloadURLs
Vcp_RspGetComponentVersion
Vcp_RspIsComponentOutOfDate
Vcp_SetProxy
Vcp_SetRunOnce
Vcp_UpdateVcp

Sections

.text
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c95196ca470cca3e5e5786e7eea5e3c6

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

wsock32

comctl32

Exports

Exports

Sections

.text Size: 133KB - Virtual size: 133KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 17KB - Virtual size: 23KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 23KB - Virtual size: 23KB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 133KB - Virtual size: 133KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 17KB - Virtual size: 23KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 23KB - Virtual size: 23KB

.reloc
Size: 12KB - Virtual size: 11KB