479d4cc8daea6785e75363c6eae128df_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

479d4cc8daea6785e75363c6eae128df_JaffaCakes118
Size

729KB
MD5

479d4cc8daea6785e75363c6eae128df
SHA1

f6bd2c3cee342bcf66d300157c58793d086d3e7b
SHA256

982f3c2b0713cf96ae44a51c34b858b1260c8dc985155c49b3a8007dbd1751f0
SHA512

4d22c9eb5cc2119a0594f73d3f81dd6f5753c09d3b8eaa68d4009ec4534aeb71a561279c2ff123eaac711c9d2f888c20d51ee73fdecd3b3959126d821568fceb
SSDEEP

12288:3eLwnl+jMPbrRoXt2v6DD3+Nza+PtMnO60mCoEiiqo0byOllKZgpNzSSogeL9/tu:3eJjMPbrRoXE6DD3+N5PtMnLc0Nytqgc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
479d4cc8daea6785e75363c6eae128df_JaffaCakes118

Files

479d4cc8daea6785e75363c6eae128df_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

8be1e71135249182f5f05114ab9256cc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

sapi.pdb

Imports

kernel32

lstrlenW
GetModuleFileNameA
GetModuleFileNameW
CreateEventA
CreateEventW
lstrlenA
WaitForSingleObject
CreateFileA
CreateFileW
GetFileInformationByHandle
ReadFile
WriteFile
SetFilePointer
SetEndOfFile
LockFileEx
UnlockFileEx
DuplicateHandle
GetCurrentProcess
InterlockedIncrement
InterlockedDecrement
ReleaseMutex
DeleteFileA
DeleteFileW
CreateDirectoryA
CreateDirectoryW
GetFileAttributesA
GetFileAttributesW
CreateMutexA
CreateMutexW
OpenEventA
InterlockedExchange
ReleaseSemaphore
CreateSemaphoreA
GetThreadPriority
GetQueuedCompletionStatus
GetSystemInfo
CreateIoCompletionPort
WaitForMultipleObjects
PostQueuedCompletionStatus
SetThreadPriority
lstrcmpiA
IsDBCSLeadByte
lstrcpynA
HeapDestroy
lstrcpyA
lstrcatA
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetShortPathNameA
MoveFileA
MoveFileW
CreateFileMappingA
CreateFileMappingW
CompareStringA
CompareStringW
UnmapViewOfFile
MapViewOfFile
GetFileSize
GlobalMemoryStatus
GetModuleHandleA
SystemTimeToFileTime
GetSystemTime
LoadLibraryA
GetFullPathNameW
GlobalUnlock
GlobalLock
Sleep
SetLastError
IsValidLocale
LoadLibraryExW
FindResourceExA
FindResourceExW
LockResource
OpenProcess
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsSetValue
GetCommandLineA
HeapFree
HeapAlloc
ExitThread
TlsGetValue
CreateThread
HeapReAlloc
ExitProcess
TlsFree
TlsAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
VirtualProtect
VirtualQuery
LCMapStringA
LCMapStringW
VirtualAlloc
RtlUnwind
GetACP
GetOEMCP
GetCPInfo
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
SetStdHandle
FlushFileBuffers
GetVersionExA
LoadLibraryW
GetUserDefaultLangID
GetProcAddress
FreeLibrary
MultiByteToWideChar
GetLastError
WideCharToMultiByte
GetTickCount
ResetEvent
SetEvent
CloseHandle
CreateProcessA
DeleteCriticalSection
InitializeCriticalSection
IsBadCodePtr
LeaveCriticalSection
EnterCriticalSection
IsBadReadPtr
GetFullPathNameA
IsBadWritePtr

user32

GetDlgItem
wsprintfA
SendMessageA
LoadStringA
DefWindowProcA
EnableWindow
EndDialog
GetWindowLongA
SetFocus
DialogBoxParamA
SetCursor
SetWindowLongA
GetFocus
IsWindow
UnregisterClassA
DispatchMessageA
DestroyWindow
PostMessageA
RegisterClassA
CreateWindowExA
CharNextA
FindWindowA
SetTimer
KillTimer
SetWindowTextA
SendMessageTimeoutA
PeekMessageA
MsgWaitForMultipleObjects
LoadCursorA

advapi32

RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyExW
RegQueryValueExA
RegQueryValueExW
RegCloseKey
RegDeleteKeyA
RegDeleteKeyW
RegEnumKeyExA
RegEnumKeyExW
RegDeleteValueA
RegDeleteValueW
RegEnumValueA
RegEnumValueW
RegSetValueExA
RegSetValueExW
RegQueryInfoKeyA
GetUserNameA
GetUserNameW
RegOpenKeyExW

ole32

CoInitializeEx
CoUninitialize
CoTaskMemRealloc
CLSIDFromProgID
GetHGlobalFromStream
StringFromGUID2
CoCreateGuid
CLSIDFromString
CreateStreamOnHGlobal
StringFromIID
IIDFromString
StringFromCLSID
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoDisconnectObject

oleaut32

SafeArrayAccessData
SafeArrayUnaccessData
VariantClear
SysAllocString
SafeArrayCreateVector
VarUI4FromStr
SafeArrayRedim
RegisterTypeLi
SysStringLen
LoadRegTypeLi
VariantInit
SysAllocStringLen
VariantCopy
VarDecRound
SysFreeString
LoadTypeLi
VariantChangeType

winmm

waveInAddBuffer
waveInPrepareHeader
waveInUnprepareHeader
waveOutUnprepareHeader
waveOutWrite
waveOutPrepareHeader
mixerGetID
mixerClose
mixerOpen
waveInGetNumDevs
waveOutGetNumDevs
waveOutGetDevCapsA
waveOutGetDevCapsW
waveInGetDevCapsA
waveInGetDevCapsW
waveInReset
waveInStop
waveInStart
waveInOpen
waveInClose
waveOutReset
waveOutPause
waveOutRestart
waveOutOpen
waveOutClose
waveOutGetPosition
mixerGetLineInfoA
mixerGetLineControlsA
mixerGetControlDetailsA
mixerSetControlDetails
mmioClose
mmioSeek
mmioRead
mmioWrite
mmioDescend
mmioAscend
mmioCreateChunk
mmioOpenA
mmioOpenW

shlwapi

ord437

urlmon

URLOpenBlockingStreamW

msacm32

acmStreamPrepareHeader
acmStreamConvert
acmStreamUnprepareHeader
acmStreamSize
acmStreamOpen
acmStreamClose
acmFormatSuggest

shfolder

SHGetFolderPathW

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
RunSapiServer

Sections

.text
Size: 488KB - Virtual size: 487KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 196KB - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8be1e71135249182f5f05114ab9256cc

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

oleaut32

winmm

shlwapi

urlmon

msacm32

shfolder

version

Exports

Exports

Sections

.text Size: 488KB - Virtual size: 487KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 196KB - Virtual size: 195KB

.reloc Size: 32KB - Virtual size: 32KB

.text
Size: 488KB - Virtual size: 487KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 196KB - Virtual size: 195KB

.reloc
Size: 32KB - Virtual size: 32KB