3e1a5dfad485fb4dbeb6f79d294a4625_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3e1a5dfad485fb4dbeb6f79d294a4625_JaffaCakes118
Size

284KB
MD5

3e1a5dfad485fb4dbeb6f79d294a4625
SHA1

d414f6d6b580702b0a477ede2bf21a6c0b7b57f0
SHA256

da1d54ff12cf42d00b63fcedaf6c315449e05f561dbf85bd33e3cf72c932c1e7
SHA512

090e3f53ca7abe402acdcc9681104751e9efe8fda909151711a2bef23368794937b01915203c03a9f5d69866c1c5eb7272aba2012690450ed09685b3f7c8a51a
SSDEEP

3072:zjDEURdhg4k++jHjBkRKuI5+t1Vavx/nbySW4Jf9p0NtAvzrqJn3aAyt82KJKrlp:Fc4k++jHd4I5FvxdJ1P7OJ3vn2nURkh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e1a5dfad485fb4dbeb6f79d294a4625_JaffaCakes118

Files

3e1a5dfad485fb4dbeb6f79d294a4625_JaffaCakes118
.dll windows:4 windows x86 arch:x86

1332b8aa5434caeeacf3a551907d306f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LocalReAlloc
TlsGetValue
SetErrorMode
GlobalFlags
GetProcessVersion
GetCPInfo
GetOEMCP
GetCurrentDirectoryA
RtlUnwind
GetCommandLineA
RaiseException
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetACP
CreateThread
ExitThread
ExitProcess
HeapSize
HeapReAlloc
SetStdHandle
GetFileType
LCMapStringA
LCMapStringW
TlsSetValue
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetHandleCount
GetStdHandle
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetDriveTypeA
IsBadReadPtr
IsBadCodePtr
CompareStringA
CompareStringW
SetEnvironmentVariableA
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
ReleaseMutex
CreateMutexA
GetCurrentThread
FindNextFileA
LocalAlloc
SuspendThread
SetThreadPriority
SetLastError
GetFileTime
GetFileSize
GetFullPathNameA
lstrcpynA
GetVolumeInformationA
FindFirstFileA
FindClose
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
DuplicateHandle
lstrcmpA
GlobalLock
GlobalUnlock
FileTimeToLocalFileTime
FileTimeToSystemTime
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
FormatMessageA
LocalFree
TerminateProcess
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
ReadProcessMemory
VirtualFreeEx
GetExitCodeThread
OpenProcess
GetVersion
GetFileAttributesA
SetEvent
CreateEventA
ResumeThread
LoadLibraryA
FreeLibrary
CreateProcessA
GetExitCodeProcess
WaitForSingleObject
GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetVersionExA
QueryPerformanceFrequency
QueryPerformanceCounter
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
GlobalAlloc
GlobalFree
GetFileAttributesExA
GetPrivateProfileStringA
ExpandEnvironmentStringsA
GetShortPathNameA
Sleep
MoveFileA
CreateDirectoryA
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WritePrivateProfileStringA
GetLastError
GetModuleFileNameA
GetCurrentThreadId
GetCurrentProcessId
MultiByteToWideChar
lstrlenA
GetTickCount
SetFilePointer
WriteFile
ReadFile
HeapFree
HeapAlloc
lstrcmpiA
DeleteFileA
CreateFileA
CloseHandle
lstrcpyA
lstrcatA
OutputDebugStringA
InterlockedDecrement
GetEnvironmentVariableA
InterlockedIncrement

user32

DrawTextA
TabbedTextOutA
DestroyMenu
GetSysColorBrush
LoadCursorA
ClientToScreen
PtInRect
GetClassNameA
LoadStringA
UnregisterClassA
SetCursor
PostQuitMessage
GetMessageA
TranslateMessage
ValidateRect
GetCursorPos
CharUpperA
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetNextDlgTabItem
IsWindowEnabled
ShowWindow
SetWindowTextA
LoadIconA
GrayStringA
GetSysColor
PeekMessageA
wsprintfA
PostMessageA
SetTimer
KillTimer
EnableWindow
wvsprintfA
MessageBoxA
DispatchMessageA
GetFocus
SetFocus
AdjustWindowRectEx
GetClientRect
IsWindowVisible
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetDlgItem
GetWindowTextA
GetDlgCtrlID
GetKeyState
DestroyWindow
CreateWindowExA
MapWindowPoints
SetWindowsHookExA
CallNextHookEx
RegisterWindowMessageA
GetWindowLongA
GetParent
CopyRect
GetWindowRect
SetWindowLongA
ReleaseDC
GetDC
GetActiveWindow
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
SendMessageA
GetWindow
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics

gdi32

Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
GetStockObject
SelectObject
GetClipBox
SetTextColor
SetBkColor
GetObjectA
RestoreDC
CreateBitmap
DeleteObject
GetDeviceCaps
DeleteDC
SaveDC

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

advapi32

RegEnumValueA
RegOpenKeyExA
RegEnumKeyA
RegCreateKeyExA
LookupAccountSidA
LookupPrivilegeValueA
AdjustTokenPrivileges
EnumServicesStatusA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
RegDeleteKeyA
OpenProcessToken
RegCloseKey
RegSetValueExA
RegCreateKeyA
RegOpenKeyA
RegSetValueA
RegQueryValueExA
RegQueryValueA
RegDeleteValueA
GetTokenInformation

shell32

ord680
SHGetDesktopFolder
SHGetSpecialFolderPathA
ShellExecuteA

comctl32

ord17

oleaut32

SysFreeString
VariantClear
SysAllocStringLen
SysAllocString

wsock32

WSAStartup
WSACleanup
gethostbyname
inet_addr

wininet

InternetCanonicalizeUrlA
InternetQueryDataAvailable
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetSetOptionExA
InternetOpenUrlA
InternetQueryOptionA
HttpSendRequestA
InternetReadFile
HttpQueryInfoA
HttpOpenRequestA
InternetConnectA
InternetCrackUrlA
InternetSetOptionA
InternetCloseHandle
InternetOpenA
InternetGetLastResponseInfoA

psapi

EnumProcesses
GetModuleFileNameExA

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Exports

Exports

BeforeNavigate2
ConnectBrowser
DocumentComplete
ExecuteRMRun
NSIS_Base64Encoding
NSIS_CheckSetupExist
NSIS_ClearForUpdate
NSIS_GetInstalledDRVersion
NSIS_GetInstalledVersion
NSIS_IsPatchStartible
NSIS_PatchNotify
NSIS_RemoveNotify
NSIS_SetupNotify
NSIS_SetupVersionCheck
NavigateComplete2
NewWindow2
NewWindow3
OnAddressBar
OnMenuBar
OnToolBar
Quit
SetupRegisterServer
SetupUnregisterServer

Sections

.text
Size: 172KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

SHARED_M
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1332b8aa5434caeeacf3a551907d306f

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oleaut32

wsock32

wininet

psapi

iphlpapi

version

Exports

Exports

Sections

.text Size: 172KB - Virtual size: 170KB

.rdata Size: 40KB - Virtual size: 36KB

.data Size: 28KB - Virtual size: 39KB

SHARED_M Size: 4KB - Virtual size: 4B

.rsrc Size: 12KB - Virtual size: 8KB

.reloc Size: 24KB - Virtual size: 23KB

.text
Size: 172KB - Virtual size: 170KB

.rdata
Size: 40KB - Virtual size: 36KB

.data
Size: 28KB - Virtual size: 39KB

SHARED_M
Size: 4KB - Virtual size: 4B

.rsrc
Size: 12KB - Virtual size: 8KB

.reloc
Size: 24KB - Virtual size: 23KB