3aee06f2ca0b2a55e46972eff6ace3d0_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

3aee06f2ca0b2a55e46972eff6ace3d0_JaffaCakes118
Size

376KB
MD5

3aee06f2ca0b2a55e46972eff6ace3d0
SHA1

2cb4d94debc5a42a7c04db708ee6530c8215b437
SHA256

1b5aaeda84b304b8fbd3555a64f91b1d83ab0f8a0349960bd087cdd72f2fc925
SHA512

5c7216ff0a31753fa5ef96a7fd468b0109bb49678121a851c0e895f710a8e0cf7fa245d875f21609028e6a77286a9eb7984656cff9d78b35b1d8f4a1da78c910
SSDEEP

6144:cMiVjXvzqMJQLRwqlhlIsEG+AazVTBfvuF/5a3l/YE6tTsodvl9u22H1KL2tZn:B4aMqLdizVTlvuiwE6xQ2XqtZn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3aee06f2ca0b2a55e46972eff6ace3d0_JaffaCakes118

Files

3aee06f2ca0b2a55e46972eff6ace3d0_JaffaCakes118
.dll windows:4 windows x86 arch:x86

61341e628e1b51097035e44f07e10604

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord3136
ord4465
ord3259
ord3147
ord2982
ord5715
ord5289
ord5307
ord4699
ord4079
ord5303
ord5300
ord3346
ord2396
ord4226
ord1948
ord3262
ord2764
ord6877
ord4202
ord5683
ord5710
ord2860
ord323
ord1640
ord5785
ord2405
ord2414
ord640
ord6385
ord3318
ord1641
ord289
ord613
ord2915
ord858
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord817
ord565
ord924
ord2614
ord2726
ord1200
ord2256
ord341
ord654
ord6140
ord5858
ord6055
ord4078
ord1776
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5290
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord1601
ord541
ord801
ord6929
ord861
ord833
ord2814
ord3876
ord6069
ord2117
ord6000
ord6067
ord5655
ord6334
ord3092
ord2642
ord6199
ord2302
ord2370
ord2289
ord529
ord656
ord796
ord4853
ord4376
ord3610
ord6662
ord926
ord500
ord2086
ord5860
ord6142
ord772
ord2763
ord4277
ord6283
ord758
ord475
ord4710
ord4234
ord641
ord324
ord3597
ord4425
ord5280
ord1775
ord6052
ord2514
ord4998
ord5265
ord6453
ord1146
ord2859
ord3571
ord2820
ord6383
ord5440
ord6215
ord4299
ord5787
ord3573
ord2379
ord6380
ord6197
ord562
ord816
ord5875
ord5789
ord3626
ord3619
ord1168
ord4275
ord1949
ord2107
ord2044
ord2448
ord2841
ord6394
ord5834
ord5450
ord3663
ord536
ord2781
ord4058
ord3178
ord941
ord4278
ord5856
ord4129
ord567
ord1233
ord6442
ord818
ord3742
ord4627
ord5572
ord939
ord1187
ord533
ord5194
ord3811
ord3337
ord2818
ord6407
ord1997
ord798
ord540
ord860
ord535
ord537
ord356
ord2770
ord1980
ord668
ord800
ord1575
ord1182
ord342
ord1253
ord354
ord5186
ord665
ord5773
ord5442
ord1979
ord823
ord825
ord3402

msvcrt

strcpy
malloc
wcsstr
_mbsicmp
sscanf
wcscmp
_strlwr
_mbscmp
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
strncmp
exit
__CxxFrameHandler
memcpy
memset
_callnewh
_strupr
wcstombs
strlen
_wcsicmp
wcslen
strcmp
_CIacos
free
_except_handler3
strstr
strrchr
strcat
memmove
_ftol
memcmp
_CxxThrowException
strncpy
realloc
atoi
_vsnprintf
sprintf
printf
time
rand
srand
fprintf
_iob
calloc
abs
_purecall
system
_flushall
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
_onexit
__dllonexit
_CIpow
getenv

kernel32

ExitProcess
ExitThread
Beep
GlobalMemoryStatus
GetLogicalDrives
GetComputerNameA
InterlockedDecrement
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemInfo
VirtualQueryEx
GetEnvironmentVariableW
GetExitCodeThread
lstrlenW
ReadProcessMemory
VirtualFreeEx
DuplicateHandle
lstrcpynA
GetVersion
GetTempPathA
GetExitCodeProcess
FileTimeToLocalFileTime
FileTimeToSystemTime
SetStdHandle
GetSystemWindowsDirectoryA
GetTempFileNameA
WaitForMultipleObjectsEx
FreeConsole
AllocConsole
SetCurrentDirectoryA
CopyFileA
GetConsoleScreenBufferInfo
ReadConsoleOutputA
ReadConsoleOutputCharacterA
GetStdHandle
WriteConsoleInputA
SetFileAttributesA
WinExec
GlobalReAlloc
FormatMessageA
lstrcmpiA
OutputDebugStringA
MoveFileExA
CreateMutexA
WriteProcessMemory
CreateRemoteThread
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
OpenProcess
TerminateProcess
CreatePipe
GetStartupInfoA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
UnmapViewOfFile
GetSystemDirectoryA
HeapAlloc
GetProcessHeap
HeapFree
CreateFileMappingA
MapViewOfFile
GetLocalTime
GetTickCount
MoveFileA
WriteFile
SetFilePointer
ReadFile
CreateFileA
GetFileSize
RemoveDirectoryA
LocalAlloc
FindFirstFileA
FindNextFileA
LocalFree
FindClose
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
CreateProcessA
VirtualProtectEx
GetModuleHandleW
VirtualAllocEx
DeviceIoControl
CreateDirectoryA
GetLastError
DeleteFileA
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
WideCharToMultiByte
MultiByteToWideChar
GetWindowsDirectoryA
lstrcpyA
lstrcatA
lstrlenA
SetEvent
WaitForSingleObject
TerminateThread
CreateEventA
Sleep
GetCommandLineA
SetUnhandledExceptionFilter
Process32First
Process32Next
VirtualAlloc
GetModuleFileNameA
GetCurrentProcess
GetModuleHandleA
GetProcAddress
VirtualProtect
CreateThread
VirtualFree
GetCurrentThreadId
GetCurrentProcessId
Thread32First
OpenThread
ResumeThread
SuspendThread
Thread32Next
CreateToolhelp32Snapshot
Module32First
LoadLibraryA
FreeLibrary
Module32Next
CloseHandle

user32

keybd_event
WindowFromPoint
SetCursorPos
mouse_event
CloseClipboard
OpenClipboard
GetClipboardData
GetSystemMetrics
LoadCursorA
SetRect
GetDC
GetDesktopWindow
ReleaseDC
IsWindowUnicode
RegisterHotKey
UnregisterHotKey
GetTopWindow
GetWindowPlacement
ScreenToClient
SwapMouseButton
EnumDisplayDevicesA
CopyRect
LoadBitmapA
SystemParametersInfoA
SendMessageA
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
ExitWindowsEx
GetWindowThreadProcessId
GetKeyNameTextA
GetWindowTextA
IsWindowVisible
EnumWindows
CreateWindowExA
CloseWindow
wsprintfA
GetMessageA
GetDCEx
KillTimer
EndDialog
SetTimer
SetForegroundWindow
SetWindowPos
TranslateMessage
DispatchMessageA
DialogBoxParamA
RegisterWindowMessageA
EnumChildWindows
GetAsyncKeyState
GetKeyState
GetFocus
GetForegroundWindow
InternalGetWindowText
ShowWindow
GetWindowLongA
SendMessageTimeoutA
GetWindow
CharToOemA
IsCharAlphaNumericA
FillRect
InvalidateRect
SetWindowRgn
SetWindowLongA
DefWindowProcA
LoadIconA
RegisterClassA
GetClientRect
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation
CloseWindowStation
GetClassNameA
GetCursor
IsRectEmpty
MessageBoxA
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
GetThreadDesktop
PostThreadMessageA
PostQuitMessage
GetIconInfo
GetCursorPos
OpenDesktopA
PostMessageA
GetWindowRect
DestroyIcon
IsClipboardFormatAvailable
EnableWindow
GetWindowDC

gdi32

PatBlt
ExtCreateRegion
CombineRgn
CreateSolidBrush
CreateFontIndirectA
BeginPath
EndPath
PathToRegion
GetDeviceCaps
GetBitmapBits
CreateDCA
GetPixel
SelectObject
CreatePatternBrush
GetStockObject
SelectPalette
RealizePalette
GetObjectA
CreateCompatibleBitmap
GetDIBits
BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC
CreateDIBSection
CreateBitmap

advapi32

EnumServicesStatusA
GetSecurityInfo
RegEnumKeyA
GetUserNameA
SetSecurityInfo
ChangeServiceConfigA
StartServiceA
QueryServiceConfigA
CreateProcessAsUserA
DuplicateTokenEx
ImpersonateLoggedOnUser
GetKernelObjectSecurity
GetSecurityDescriptorDacl
MakeAbsoluteSD
SetKernelObjectSecurity
BuildTrusteeWithSidA
RevertToSelf
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegCloseKey
RegOpenKeyExA
FreeSid
SetSecurityDescriptorDacl
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CloseServiceHandle
DeleteService
ControlService
OpenServiceA
OpenSCManagerA
RegSetValueExA
RegCreateKeyA
SetEntriesInAclA
RegQueryValueExA
RegOpenKeyA
RegEnumKeyExA
RegEnumValueA
RegDeleteValueA

shell32

SHGetSpecialFolderPathA
SHGetFileInfoA
ExtractIconExA
ShellExecuteA

ole32

CoTaskMemFree
CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
CoInitialize
CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal

olepro32

ord251

oleaut32

VariantChangeType
VariantInit
SysAllocString
VariantClear
SysFreeString
GetErrorInfo

urlmon

URLDownloadToFileA

msvcp60

??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADHD@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?nothrow@std@@3Unothrow_t@1@B
??0Init@ios_base@std@@QAE@XZ

wininet

InternetGetConnectedState
InternetReadFile
InternetOpenUrlA
InternetCheckConnectionA
InternetCloseHandle
HttpQueryInfoA
InternetOpenA

msvfw32

ICInfo
ICGetInfo
ICSeqCompressFrameEnd
ICCompressorFree
ICClose
ICOpen
ICSendMessage
ICSeqCompressFrame
ICSeqCompressFrameStart

shlwapi

SHDeleteValueA
SHDeleteKeyA

imm32

ImmReleaseContext
ImmGetContext
ImmGetCompositionStringA

ntdll

ZwOpenSection
ZwOpenFile
RtlInitUnicodeString
_stricmp
_strcmpi
_strnicmp
ZwQuerySystemInformation

winmm

mixerGetID
mciSendStringA
waveOutGetDevCapsA
mixerOpen
mixerGetLineInfoA
mixerGetLineControlsA
mixerGetControlDetailsA
mixerSetControlDetails
mixerClose
sndPlaySoundA
timeGetTime
waveInGetErrorTextA
waveOutGetErrorTextA
waveOutSetVolume
waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveOutClose
waveOutUnprepareHeader
waveOutReset
waveInClose
waveInUnprepareHeader
waveInReset
waveInStop
waveOutWrite
waveInStart
waveInAddBuffer
waveInPrepareHeader
waveInOpen

psapi

GetModuleInformation

iphlpapi

GetAdaptersInfo

ws2_32

WSAGetOverlappedResult
WSAResetEvent
WSAWaitForMultipleEvents
WSAGetLastError
WSASend
WSARecv
__WSAFDIsSet
WSAAsyncSelect
inet_ntoa
WSAConnect
sendto
WSAAsyncGetHostByName
getpeername
recvfrom
WSASocketA
getsockname
gethostname
listen
inet_addr
ioctlsocket
accept
htonl
WSACloseEvent
WSACreateEvent
WSAStartup
WSACleanup
setsockopt
connect
htons
gethostbyname
socket
closesocket
ntohs
recv
select
send
bind

Exports

Exports

start
test

Sections

.text
Size: 216KB - Virtual size: 213KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

61341e628e1b51097035e44f07e10604

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ole32

olepro32

oleaut32

urlmon

msvcp60

wininet

msvfw32

shlwapi

imm32

ntdll

winmm

psapi

iphlpapi

ws2_32

Exports

Exports

Sections

.text Size: 216KB - Virtual size: 213KB

.rdata Size: 56KB - Virtual size: 55KB

.data Size: 60KB - Virtual size: 2.6MB

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 36KB - Virtual size: 35KB

.text
Size: 216KB - Virtual size: 213KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 60KB - Virtual size: 2.6MB

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 36KB - Virtual size: 35KB