3b58184214f3510af763c4ca1a218b74_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3b58184214f3510af763c4ca1a218b74_JaffaCakes118
Size

65KB
MD5

3b58184214f3510af763c4ca1a218b74
SHA1

e955e3bfafe165d8bb3356f125cfa2d64d910a92
SHA256

d5263b5fffc13b218f73c5b1417215e957ea1b85d3f36e690e79e9b141de9887
SHA512

3d3b430c038d19ed5a4a59eaa733adab00d084645b744207ebc10a1105db82ec2245c8ceb9566b0ea820bd2dd53ae34b09c4c4d50b12f9d4a2115685e843509a
SSDEEP

768:AbG8SjGucxcHk2+EpvRDQy0YroMPVIe3SKcgFOqa5xj/VRbO/qYD/96woDa+GVVQ:CyfHk2xDQy0MPVIeKgODOCWLKxcF1g

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b58184214f3510af763c4ca1a218b74_JaffaCakes118

Files

3b58184214f3510af763c4ca1a218b74_JaffaCakes118
.dll windows:4 windows x86 arch:x86

01357a0296ab3059b4713c5191b70eb8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

ExitWindowsEx
SendInput
wsprintfA
GetThreadDesktop
PostMessageA
OpenDesktopA
CallNextHookEx
GetForegroundWindow
UnhookWindowsHookEx
SetWindowsHookExW
GetWindowTextA
GetWindowThreadProcessId
wsprintfW
GetMessageA
GetActiveWindow
CharLowerA
CharUpperA
PostThreadMessageA
EnumWindows
UpdateWindow
BringWindowToTop
ShowWindow
DestroyWindow
DispatchMessageA
SendMessageA
OpenInputDesktop
SetThreadDesktop
MessageBoxA
SetCursorPos
OpenWindowStationA
SetProcessWindowStation
CloseDesktop
CloseWindowStation
IsWindow

gdi32

GetDIBits
GetDeviceCaps
CreateDCA
CreateCompatibleDC
SelectObject
DeleteObject
CreateCompatibleBitmap
DeleteDC
BitBlt

advapi32

RegQueryValueExA
CreateServiceA
StartServiceA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
QueryServiceConfigA
EnumServicesStatusA
ChangeServiceConfigA
RegCreateKeyExA
RegSetValueExA
OpenProcessToken
RegOpenKeyExA
OpenServiceA
RegCloseKey
GetUserNameW
LookupPrivilegeValueA
ImpersonateSelf
OpenThreadToken
AdjustTokenPrivileges
OpenSCManagerA
DeleteService
ControlService
CloseServiceHandle

shell32

ShellExecuteA
SHFileOperationA
SHEmptyRecycleBinA

ole32

CreateStreamOnHGlobal

ws2_32

listen
setsockopt
bind
socket
htons
send
closesocket
ntohs
accept
WSADuplicateSocketA
WSAStartup
select
recv
inet_addr
gethostbyname
inet_ntoa
connect
getsockname

shlwapi

StrStrIA
StrChrA
StrStrA
StrRChrA
SHDeleteKeyA
StrCmpNIA
StrCmpW
StrToIntA

psapi

GetModuleFileNameExA

imm32

ImmReleaseContext
ImmGetCompositionStringW
ImmGetCompositionStringA
ImmGetContext

avicap32

capCreateCaptureWindowA
capGetDriverDescriptionA

winmm

waveInUnprepareHeader
waveInPrepareHeader
waveInAddBuffer
waveInStart
waveInStop
waveInClose
waveInOpen

msvcrt

strrchr
__dllonexit
_onexit
_initterm
_adjust_fdiv
malloc
wcscmp
free
strchr
_beginthread
__CxxFrameHandler
??2@YAPAXI@Z
??3@YAXPAX@Z

kernel32

MoveFileA
GetDriveTypeA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetLogicalDriveStringsA
GetFileAttributesExA
FindClose
GetLastError
lstrcmpA
FindNextFileA
FindFirstFileA
lstrcmpiA
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateProcess
DuplicateHandle
SetStdHandle
CreatePipe
GetStdHandle
ExitProcess
GetCommandLineA
GetProcAddress
FreeLibrary
LocalAlloc
InterlockedExchange
SearchPathA
WideCharToMultiByte
SetFilePointer
FlushFileBuffers
lstrlenW
lstrcatW
OpenEventA
OpenMutexA
GetFileSize
GlobalAlloc
GlobalLock
lstrcpyW
WaitForMultipleObjects
ResetEvent
ReleaseMutex
GlobalFree
CreateEventA
CreateMutexA
GetFileSizeEx
SetFilePointerEx
ReadFile
GetCurrentProcess
GetPriorityClass
GetThreadPriority
SetPriorityClass
SetThreadPriority
QueryPerformanceFrequency
QueryPerformanceCounter
GetVersion
GetVersionExA
GetSystemInfo
GlobalMemoryStatus
GetComputerNameA
GetACP
GetOEMCP
GetLocalTime
GetTempPathA
WriteFile
GetModuleFileNameA
OpenProcess
GetSystemDirectoryA
RaiseException
LoadLibraryA
CreateDirectoryA
GetCurrentThread
SetEvent
GetCurrentProcessId
lstrlenA
DeviceIoControl
CreateFileA
CloseHandle
DeleteFileA
lstrcpyA
GetStartupInfoA
lstrcatA
CreateProcessA
GetCurrentThreadId
Sleep
WaitForSingleObject
GetTickCount

Exports

Exports

DoMainWork
DoService
ServiceMain

Sections

.text
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Share
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

01357a0296ab3059b4713c5191b70eb8

Headers

File Characteristics

Imports

user32

gdi32

advapi32

shell32

ole32

ws2_32

shlwapi

psapi

imm32

avicap32

winmm

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 46KB - Virtual size: 46KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 2KB - Virtual size: 2KB

Share Size: 4KB - Virtual size: 4KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 46KB - Virtual size: 46KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 2KB - Virtual size: 2KB

Share
Size: 4KB - Virtual size: 4KB

.reloc
Size: 3KB - Virtual size: 3KB