3e15ada51d584356ff47431c4b86d270_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

3e15ada51d584356ff47431c4b86d270_JaffaCakes118
Size

52KB
MD5

3e15ada51d584356ff47431c4b86d270
SHA1

2a461c9e88121cdc6fdc478e9f7855c808015dc2
SHA256

cc978615f547c16786cab14b7c3662f3c5706d9ec0c090bdacbce21d4df96c78
SHA512

5cf7c6c1c8e79999f6c357b1193ebbdca5e4ed5ad734010e86a17c3ae49301f9fd113517c6648f655489807ab270c765d8f72bd97e8a9c1a73e4fbf379050d19
SSDEEP

1536:cMVCJZjUlmd7217U0bGAtx+fHBDUTEruZwjLX:vIJFQUrAtMrowv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e15ada51d584356ff47431c4b86d270_JaffaCakes118

Files

3e15ada51d584356ff47431c4b86d270_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

7ac7c3d863d69e6a0bd66bd1d0ec5219

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MoveFileA
GetCommandLineW
lstrlenW
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
FreeLibrary
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
RemoveDirectoryA
Process32Next
Process32First
GetExitCodeProcess
WaitForSingleObject
CreateDirectoryA
ExitProcess
CreateThread
Sleep
FindFirstFileA
GetPrivateProfileStringA
FindNextFileA
GetSystemDirectoryA
CreateProcessA
CloseHandle
LoadLibraryA
GetProcAddress
SetFileAttributesA
LocalFree
lstrlenA
MultiByteToWideChar
GetModuleFileNameA
DeleteFileA
WritePrivateProfileStringA
GetCurrentProcessId
InterlockedIncrement

advapi32

RegQueryInfoKeyA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA

shell32

SHGetSpecialFolderPathA
CommandLineToArgvW

ole32

CoGetInterfaceAndReleaseStream
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize

oleaut32

SysStringLen
LoadRegTypeLi
SysFreeString
SysAllocString
VariantClear

msvcrt

strrchr
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
strcmp
atoi
_access
strncmp
strchr
strncpy
_purecall
strcpy
memcpy
sprintf
??3@YAXPAX@Z
fclose
fread
memset
??2@YAPAXI@Z
ftell
fseek
fopen
strcat
_strlwr
strlen
strstr
wcsstr
_wcslwr
memcmp

shlwapi

SHSetValueA
SHDeleteKeyA
SHDeleteValueA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

idata
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7ac7c3d863d69e6a0bd66bd1d0ec5219

Headers

File Characteristics

Imports

kernel32

advapi32

shell32

ole32

oleaut32

msvcrt

shlwapi

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 28KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 4KB

idata Size: 4KB - Virtual size: 4B

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 32KB - Virtual size: 28KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 4KB

idata
Size: 4KB - Virtual size: 4B

.reloc
Size: 4KB - Virtual size: 2KB