4101331fe3823c471005f7df241d0370_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4101331fe3823c471005f7df241d0370_JaffaCakes118
Size

492KB
MD5

4101331fe3823c471005f7df241d0370
SHA1

5ea9c5c3eccc6a765882b9a22d61de4faef0aefb
SHA256

9affa5c5155d9c934bb6a51acf97660b363aa51eb83535af877658d1ce8312e0
SHA512

6e6ea6ed6db0f66afd26bc99da98c9e481b6e76552c690be89b09e45a20cb97b0fcc2c2a3ff03588b6847181b4c65d57e597a2d5514d94d7f294139506f64680
SSDEEP

12288:skvf8/jXhvgBO6QSgX4cRAJ3+eFVUjkeBJT:dX8/jXFgBXPgX4cGJxUQw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4101331fe3823c471005f7df241d0370_JaffaCakes118

Files

4101331fe3823c471005f7df241d0370_JaffaCakes118
.dll windows:1 windows x86 arch:x86

734e4b74927cc9ae8aa7ffc2211a4e9f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

comctl32

ImageList_Destroy
ImageList_ReplaceIcon
InitCommonControlsEx
InitCommonControls
ImageList_Remove
ImageList_GetIcon
ImageList_LoadImageA

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontIndirectA
CreateSolidBrush
DeleteDC
DeleteObject
GetDeviceCaps
GetStockObject
GetTextMetricsA
MoveToEx
SelectObject
SetBkColor
SetBkMode
SetTextAlign
SetTextColor

kernel32

CloseHandle
CreateFileA
DeleteFileA
EnumResourceNamesA
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
GetCommandLineA
GetFileAttributesA
GetFileSize
GetFileType
GetLastError
GetLocalTime
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetStringTypeA
GetVersionExA
GetVolumeInformationA
GlobalAlloc
GlobalFree
GlobalReAlloc
LoadLibraryA
MultiByteToWideChar
ReadFile
SetEndOfFile
SetErrorMode
SetFilePointer
SetLastError
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WideCharToMultiByte
WriteFile
FileTimeToSystemTime
FreeLibrary
GetSystemTime
SystemTimeToFileTime
RtlMoveMemory

ole32

CLSIDFromProgID
CoCreateInstance
CoInitialize
CoUninitialize
ProgIDFromCLSID

oleaut32

GetActiveObject
SafeArrayCreate
SysAllocStringByteLen
SysFreeString
SysStringByteLen
VariantClear
VariantCopy

user32

CallWindowProcA
CharLowerBuffA
CharNextA
CharUpperBuffA
CheckRadioButton
ClientToScreen
CreateDialogIndirectParamA
CreateDialogParamA
CreateWindowExA
DestroyIcon
DestroyWindow
DialogBoxIndirectParamA
DispatchMessageA
EnableWindow
FillRect
GetClientRect
GetCursorPos
GetDC
GetDlgItem
GetMenu
GetMenuItemInfoA
GetSysColor
GetSysColorBrush
GetWindowLongA
GetWindowRect
GetWindowTextA
GetWindowTextLengthA
IsDialogMessageA
IsWindow
LoadImageA
MapDialogRect
MessageBoxA
PeekMessageA
PostMessageA
RedrawWindow
ReleaseDC
ScreenToClient
SendMessageA
SetFocus
SetForegroundWindow
SetWindowLongA
SetWindowPos
SetWindowTextA
ShowWindow
SystemParametersInfoA
TranslateMessage
DialogBoxParamA
GetFocus
GetWindow

cheetah2

XDBOPEN
XDBCLOSE
XDBCLOSEALLINDEXES
XDBGETRECORD
XDBDELETED
XDBRECORDCOUNT
XDBRECORDNUMBER
XDBFIELDVALUE
XDBOPENINDEX
XDBCLOSEINDEX
XDBSEEK
XDBRESETERROR
XDBERROR

Exports

Exports

FreeMem
GetAsciiz
GetMem
LOADGUI
XMLATTRIBTOLIST
XMLPARSEFILETOSTRING
llAdd
llCapacity
llCount
llData
llDataByName
llDelete
llDeleteByName
llDelimToList
llFindByData
llFindByName
llFindLast
llFindPrev
llFindSmallest
llFree
llGetByNumber
llLastError
llListFromFile
llListToFile
llMoveFirst
llName
llNext
llSort
llUpdate
llUpdateByName
ll_xmlClean
ll_xmlUnClean
llbAdd
llbData
llbDataByName
llbUpdate
llbUpdateByName
llzAdd
llzData
llzDataByName
llzDeleteByName
llzDelimToList
llzFindByData
llzFindByName
llzLastError
llzListFromFile
llzListToFile
llzName
llzUpdate
llzUpdateByName
xmlAddChild
xmlAddSimpleChild
xmlAttribCount
xmlAttribExists
xmlAttribName
xmlAttribToString
xmlAttribValue
xmlChild
xmlChildData
xmlClean
xmlExtractSimpleChildData
xmlFindDataChild
xmlFindNode
xmlFindNodeRecursive
xmlFree
xmlFreePointers
xmlFromList
xmlGetChildTagData
xmlGetTag
xmlLastError
xmlNextSibling
xmlNodeToFile
xmlNodeToString
xmlNodeType
xmlParent
xmlParse
xmlParseFile
xmlSetAttrib
xmlToList
xmlTreeToFile
xmlTreeToFile2
xmlTreeToString
xmlUnClean
xmlzAddSimpleChild
xmlzAttribExists
xmlzAttribName
xmlzAttribToString
xmlzAttribValue
xmlzChildData
xmlzClean
xmlzExtractSimpleChildData
xmlzFindNode
xmlzFromList
xmlzGetChildTagData
xmlzGetTag
xmlzLastError
xmlzNodeToFile
xmlzNodeToString
xmlzParse
xmlzParseFile
xmlzSetAttrib
xmlzTreeToString
xmlzUnClean

Sections

.text
Size: 431KB - Virtual size: 430KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.link
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

734e4b74927cc9ae8aa7ffc2211a4e9f

Headers

File Characteristics

Imports

comctl32

gdi32

kernel32

ole32

oleaut32

user32

cheetah2

Exports

Exports

Sections

.text Size: 431KB - Virtual size: 430KB

.data Size: 29KB - Virtual size: 40KB

.link Size: 6KB - Virtual size: 6KB

.rloc Size: 24KB - Virtual size: 23KB

.text
Size: 431KB - Virtual size: 430KB

.data
Size: 29KB - Virtual size: 40KB

.link
Size: 6KB - Virtual size: 6KB

.rloc
Size: 24KB - Virtual size: 23KB