46cd233c8787cecef1f23f7bd6c64f0b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

46cd233c8787cecef1f23f7bd6c64f0b_JaffaCakes118
Size

603KB
MD5

46cd233c8787cecef1f23f7bd6c64f0b
SHA1

519ed4768351ce5c4eb9d17458c0dad4618c1258
SHA256

1fb4efe48b2a919ffc90ca32b583369b6397e5cf4707c88134ff7b1fbdd82abf
SHA512

42f2a5962e7adffbd4b0f332ca62887b19501b034270d658534c2def4388e487f4b51b01fb5789663b97128c4eb0635653ab4f9941e66f71e9ac150dbb39c970
SSDEEP

12288:MN7JrjMAHcvZmfSqWWcn/u4cjmy18bdkkYvyhKC4L7jCWQ:MN7xjZHmZmfQuV8bvYvyhKC4L7jC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
46cd233c8787cecef1f23f7bd6c64f0b_JaffaCakes118

Files

46cd233c8787cecef1f23f7bd6c64f0b_JaffaCakes118
.dll windows:5 windows x86 arch:x86

9ab6543bdfd80737811e62eeca640b36

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

InternetGetConnectedState

shell32

SHGetFolderPathA
ShellExecuteExA
SHFileOperationA

kernel32

GetCurrentThreadId
lstrcmpA
GetVersionExA
GlobalAlloc
GlobalFree
IsDBCSLeadByte
GlobalLock
FreeLibrary
lstrcmpiA
InterlockedIncrement
GlobalUnlock
MulDiv
GetShortPathNameA
GetCurrentProcess
DeviceIoControl
TerminateProcess
WaitForSingleObject
OpenProcess
GetVersion
Sleep
DeleteFileA
WritePrivateProfileStringA
CreateThread
CreateProcessA
GetPrivateProfileIntA
GetPrivateProfileStringA
IsWow64Process
GetExitCodeProcess
Process32First
CreateToolhelp32Snapshot
Process32Next
GetCurrentProcessId
CreateMutexW
LoadLibraryW
FindFirstFileA
FindNextFileA
FindClose
Process32FirstW
Process32NextW
GetWindowsDirectoryA
CopyFileA
GetWindowsDirectoryW
GetTickCount
GetModuleHandleW
WriteConsoleW
CreateFileW
SetStdHandle
GetCommandLineW
GetCommandLineA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
MoveFileExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleCP
GetACP
GetFileType
GetStdHandle
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetModuleHandleExW
ExitProcess
FindResourceA
VirtualProtect
GetSystemInfo
InterlockedFlushSList
GetModuleFileNameW
LoadLibraryExW
RtlUnwind
QueryPerformanceCounter
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
SetEvent
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
LoadLibraryExA
InterlockedDecrement
EnterCriticalSection
SetLastError
GlobalHandle
GetProcAddress
GetModuleHandleA
FlushFileBuffers
CreateDirectoryA
GetSystemTimeAsFileTime
WideCharToMultiByte
GetFileSize
FindResourceW
LoadResource
FindResourceExW
CloseHandle
LockResource
CreateFileA
GetFileAttributesA
MultiByteToWideChar
SetEndOfFile
SetFilePointer
WriteFile
GetFileSizeEx
SizeofResource
GetModuleFileNameA
ReadFile
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionAndSpinCount
HeapFree
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
VirtualQuery
LeaveCriticalSection

user32

GetWindowTextLengthA
GetParent
RegisterClassExA
ReleaseCapture
InvalidateRect
ReleaseDC
GetDesktopWindow
GetDlgItem
GetClientRect
MapDialogRect
SetCapture
SendMessageA
SetWindowContextHelpId
SendDlgItemMessageA
SetFocus
CreateWindowExA
BeginPaint
DefWindowProcA
MoveWindow
EndPaint
GetSysColor
SetMenuDefaultItem
SetWindowTextA
GetWindowLongA
CreateAcceleratorTableA
IsChild
EnableWindow
UnregisterClassA
GetMenuItemInfoA
GetWindowThreadProcessId
PostMessageA
MessageBoxA
EnumWindows
CharNextA
CheckMenuRadioItem
GetWindow
GetFocus
LoadCursorA
DestroyWindow
GetDC
SetWindowPos
FillRect
ScreenToClient
EndDialog
GetClassNameA
GetActiveWindow
IsWindow
DialogBoxIndirectParamA
InvalidateRgn
GetClassInfoExA
RegisterWindowMessageA
RedrawWindow
IsDialogMessageA
SetMenuItemInfoA
SetWindowLongA
ClientToScreen
CallWindowProcA
DestroyAcceleratorTable
GetWindowTextA

gdi32

BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetStockObject
GetDeviceCaps
DeleteDC
DeleteObject
CreateSolidBrush
GetObjectA

advapi32

SystemFunction036
RegDeleteValueA
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
CreateServiceA
ControlService
QueryServiceStatus
QueryServiceStatusEx
StartServiceW
OpenServiceW
OpenSCManagerW
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CloseServiceHandle
OpenSCManagerA
DeleteService
OpenServiceA
RegDeleteKeyA
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyA
RegQueryValueExA
RegCreateKeyExA
RegEnumKeyExW
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA

ole32

OleUninitialize
CoGetClassObject
CoTaskMemAlloc
CoCreateGuid
OleLockRunning
CLSIDFromString
CoTaskMemRealloc
OleInitialize
CreateStreamOnHGlobal
CoTaskMemFree
CLSIDFromProgID
CoCreateInstance
StringFromGUID2

oleaut32

DispCallFunc
VarUI4FromStr
VariantInit
SysAllocString
VariantCopy
VarBstrCmp
LoadRegTypeLi
LoadTypeLi
OleCreateFontIndirect
SysStringLen
SysFreeString
VariantClear
SysAllocStringLen

winhttp

WinHttpSendRequest
WinHttpCrackUrl
WinHttpConnect
WinHttpSetTimeouts
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpReadData
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpOpen
WinHttpQueryDataAvailable

crypt32

CertCloseStore
CertAddEncodedCertificateToStore
CertOpenSystemStoreA

winmm

waveOutGetVolume
waveOutSetVolume

iphlpapi

GetAdaptersAddresses

Exports

Exports

AlovsiSafhab
AtauFemid
BeorDift
BhjoWodu
BotkejWin
CisvoOricsuo
CudiGim
DoigfoVacl
DukpDeiwua
DypesNoc
HahbeEjico
JogcudFumb
KadcegAzomry
KaurogSiau
LebtuGuet
LeddidDafseh
MopfyJylfuhu
MuyyqYoko
OekivNodni
OseduDilgakc
PapdEbeguob
PukadDytuur
QiurHiel
RacemGals
RunjTokvicg
SagjNecip
SasjoRygsa
SeeelMekb
SivnApijpu
WaebavBemin
WemmeoRhfodp
XailGeutbe
ZabeIboobeo

Sections

.text
Size: 436KB - Virtual size: 436KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9ab6543bdfd80737811e62eeca640b36

Headers

DLL Characteristics

File Characteristics

Imports

wininet

shell32

kernel32

user32

gdi32

advapi32

ole32

oleaut32

winhttp

crypt32

winmm

iphlpapi

Exports

Exports

Sections

.text Size: 436KB - Virtual size: 436KB

.rdata Size: 120KB - Virtual size: 120KB

.data Size: 6KB - Virtual size: 10KB

.gfids Size: 1024B - Virtual size: 584B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 36KB - Virtual size: 35KB

.text
Size: 436KB - Virtual size: 436KB

.rdata
Size: 120KB - Virtual size: 120KB

.data
Size: 6KB - Virtual size: 10KB

.gfids
Size: 1024B - Virtual size: 584B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 36KB - Virtual size: 35KB