3b35258a34a219ea14c319d3a65c1dce_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3b35258a34a219ea14c319d3a65c1dce_JaffaCakes118
Size

2.3MB
MD5

3b35258a34a219ea14c319d3a65c1dce
SHA1

376884dc34ac3db1bd5cf331df6190221ed75a63
SHA256

a63a421080956a43d3cf283d4700c38cce432e8299e66f8fdcc5ac090a9207a1
SHA512

7ab72d19a85f2e4212938ca663fed8f6a345b6308be54b0b9bcee4ff29af882099aa438b8f15d5d2d7a63f8e4c52fe5289a8d3676a7fefd433cddcbae84e5131
SSDEEP

12288:e4LeWO2I5GwbvfC4S7LU4UI7Yi66lSRiZl3JY2AkxDXqkZ8jf65n4DgSvbrU6CAH:ewJO2Ihvf1P4d66vZlTAkxDRZNyv0A

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b35258a34a219ea14c319d3a65c1dce_JaffaCakes118

Files

3b35258a34a219ea14c319d3a65c1dce_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

3e4aa03c379204971a2fbd4931349739

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Director.pdb

Imports

kernel32

UnlockFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
LockFile
GetFileAttributesExW
ResetEvent
ResumeThread
LoadLibraryExW
CreateWaitableTimerW
SetWaitableTimer
GlobalDeleteAtom
GlobalAddAtomW
GetExitCodeProcess
DuplicateHandle
SetEnvironmentVariableW
GetEnvironmentVariableW
FormatMessageW
OpenProcess
LocalAlloc
MultiByteToWideChar
WideCharToMultiByte
ProcessIdToSessionId
CompareStringW
lstrcpyW
GetCurrentThread
ReleaseMutex
CreateEventW
SetEvent
DeleteFileW
SetEnvironmentVariableA
CompareStringA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
SetConsoleCtrlHandler
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
MoveFileW
GetStdHandle
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
FatalAppExitA
HeapCreate
ExitProcess
GetModuleHandleA
GetCPInfo
LCMapStringW
LCMapStringA
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
CreateThread
ExitThread
RtlUnwind
HeapSize
HeapReAlloc
HeapDestroy
SetThreadPriority
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
GetVersionExA
GetThreadLocale
GetLocaleInfoA
InterlockedExchange
MoveFileExW
GetVolumeNameForVolumeMountPointW
GetVolumeInformationW
GetSystemTimeAsFileTime
SetFileTime
GlobalSize
CreateMutexA
GetTempFileNameW
RemoveDirectoryW
CopyFileW
GetTempPathW
CreateDirectoryW
GetACP
GetSystemDefaultLangID
GetSystemTime
lstrcpynA
LoadLibraryW
CreateProcessW
GetExitCodeThread
TerminateThread
GetFileSize
ReadFile
SetFilePointer
WriteFile
SetEndOfFile
Sleep
CreateFileW
lstrcatW
FindFirstFileW
FindNextFileW
FindClose
IsBadCodePtr
FreeLibrary
WaitForMultipleObjects
GlobalHandle
GlobalFree
CreateMutexW
GlobalLock
GlobalUnlock
SetLastError
MulDiv
lstrcmpW
GetLastError
GetCurrentThreadId
DisableThreadLibraryCalls
GetModuleFileNameW
GetSystemDirectoryW
lstrcmpiW
WaitForSingleObject
lstrcatA
CreateEventA
HeapAlloc
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CloseHandle
GetModuleHandleW
GetProcAddress
GetProcessHeap
HeapFree
GlobalAlloc
GetCurrentProcess
FlushInstructionCache
RaiseException
GetComputerNameW
lstrlenW
LocalFree
InterlockedDecrement
FindFirstFileA
FindNextFileA
GetFileAttributesW
GetComputerNameExW
ExpandEnvironmentStringsW
OpenFileMappingW
lstrcpyA
CreateFileA
lstrcpynW
CreateSemaphoreW
GlobalReAlloc
IsBadReadPtr
lstrlenA
GetFileInformationByHandle
GetLocalTime
SystemTimeToFileTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetTickCount
SetFileAttributesW
GetTimeZoneInformation
InterlockedExchangeAdd
ReleaseSemaphore
VirtualAlloc
GetVersionExW
InterlockedIncrement
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameA

user32

RegisterWindowMessageW
SetWindowLongW
GetWindowLongW
CharLowerW
DefWindowProcW
GetSysColor
CharNextW
MoveWindow
SetWindowPos
GetClientRect
ClientToScreen
ScreenToClient
GetDC
UnregisterClassA
CharUpperW
wsprintfW
GetWindowRect
MapWindowPoints
IsDlgButtonChecked
CheckDlgButton
MessageBeep
GetActiveWindow
DialogBoxIndirectParamW
LoadStringW
UnregisterHotKey
RegisterHotKey
SetDlgItemTextW
ReleaseDC
SetForegroundWindow
MessageBoxW
CharLowerBuffW
LoadBitmapW
IsIconic
GetWindowThreadProcessId
KillTimer
SetTimer
PostThreadMessageW
SystemParametersInfoW
ShowWindow
PostMessageW
LoadImageW
MapDialogRect
SetWindowContextHelpId
DestroyIcon
GetCapture
GetCursorPos
SetCursor
DrawFocusRect
PtInRect
GetDlgCtrlID
IsWindowEnabled
UpdateWindow
OffsetRect
SetRectEmpty
DrawTextW
EndDialog
MsgWaitForMultipleObjects
TranslateMessage
DispatchMessageW
PeekMessageW
CreateDialogIndirectParamW
IsWindowVisible
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
CreateAcceleratorTableW
CreateWindowExW
RegisterClassExW
LoadCursorW
GetClassInfoExW
IsWindow
SendMessageW
GetFocus
GetWindow
SetFocus
DestroyAcceleratorTable
GetDesktopWindow
BeginPaint
EndPaint
CallWindowProcW
DestroyWindow
FillRect
ReleaseCapture
GetClassNameW
GetDlgItem
GetParent
IsChild
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect

gdi32

GetObjectW
StretchBlt
CreateFontW
CreateFontIndirectW
SetTextColor
SetBkMode
SetBkColor
GetStockObject
DeleteDC
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject

advapi32

CryptGetHashParam
SetNamedSecurityInfoW
LookupAccountSidW
CryptDeriveKey
CryptDecrypt
CryptEncrypt
GetSidSubAuthorityCount
GetSidSubAuthority
InitiateSystemShutdownExW
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptReleaseContext
RegEnumKeyExW
RegQueryInfoKeyW
RegDisablePredefinedCache
RegEnumValueW
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyW
OpenProcessToken
GetTokenInformation
IsValidSid
DuplicateTokenEx
SetTokenInformation
ImpersonateLoggedOnUser
OpenThreadToken
RevertToSelf
RegGetKeySecurity
RegOpenKeyW
RegSetKeySecurity
RegQueryValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupAccountNameW
ConvertSidToStringSidW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
CryptDestroyKey
ConvertStringSidToSidW

shell32

SHGetFolderPathW
ShellExecuteW

ole32

OleUninitialize
OleInitialize
GetHGlobalFromStream
CoSetProxyBlanket
CreateStreamOnHGlobal
CoTaskMemAlloc
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
CoTaskMemFree
CoRevokeClassObject
StringFromCLSID
CoTaskMemRealloc
CoUninitialize
CoInitializeEx

oleaut32

SysStringLen
SysFreeString
SysAllocStringLen
LoadTypeLi
SysStringByteLen
VarBstrFromI4
VarBstrCmp
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayRedim
VariantInit
VariantClear
OleCreateFontIndirect
LoadRegTypeLi
SafeArrayDestroy
VarBstrCat
VarUI4FromStr
SysAllocString
SetErrorInfo
GetErrorInfo
SafeArrayCreate
VarI4FromStr
SafeArrayCreateVector
SystemTimeToVariantTime
SafeArrayGetElement
SafeArrayPutElement
VariantChangeType
SysAllocStringByteLen
CreateErrorInfo

shlwapi

PathIsDirectoryA
PathRemoveFileSpecA
PathFindFileNameA
PathAppendA
PathMatchSpecA
PathSkipRootA
PathFindFileNameW
PathMatchSpecW
PathSkipRootW
SHCreateStreamOnFileW
PathStripPathW
PathFindExtensionW
PathAppendW
PathIsDirectoryW
PathFileExistsW
PathRemoveFileSpecW

rpcrt4

UuidCreate
RpcStringFreeW
UuidToStringW
UuidFromStringW
UuidFromStringA

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

wtsapi32

WTSOpenServerW
WTSQuerySessionInformationW
WTSCloseServer
WTSFreeMemory

netapi32

NetWkstaUserEnum
NetApiBufferFree

comctl32

CreatePropertySheetPageW
DestroyPropertySheetPage
PropertySheetW
ImageList_ReplaceIcon
ImageList_Remove
ImageList_Destroy
ImageList_Create
ImageList_SetOverlayImage
InitCommonControlsEx
_TrackMouseEvent

psapi

GetModuleFileNameExW

iphlpapi

GetAdaptersInfo

proxy

??0CProxy@@QAE@XZ
??1CProxy@@QAE@XZ
?SendRemoteHttpRequest@CProxy@@QAEJPAGJPAUtagVARIANT@@1J10@Z
?Open@CProxy@@QAEJHPAX@Z

wininet

DeleteUrlCacheEntryW
FindFirstUrlCacheEntryW
FindNextUrlCacheEntryW
FindCloseUrlCache

setupapi

InstallHinfSectionW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
StartApp

Sections

.text
Size: 576KB - Virtual size: 573KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3e4aa03c379204971a2fbd4931349739

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

rpcrt4

version

wtsapi32

netapi32

comctl32

psapi

iphlpapi

proxy

wininet

setupapi

Exports

Exports

Sections

.text Size: 576KB - Virtual size: 573KB

.rdata Size: 120KB - Virtual size: 116KB

.data Size: 24KB - Virtual size: 30KB

.rsrc Size: 1.6MB - Virtual size: 1.6MB

.reloc Size: 36KB - Virtual size: 35KB

.text
Size: 576KB - Virtual size: 573KB

.rdata
Size: 120KB - Virtual size: 116KB

.data
Size: 24KB - Virtual size: 30KB

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

.reloc
Size: 36KB - Virtual size: 35KB