4a04062d3202302660f9a2cb0404cb1e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4a04062d3202302660f9a2cb0404cb1e_JaffaCakes118
Size

367KB
MD5

4a04062d3202302660f9a2cb0404cb1e
SHA1

91a7efe6638e8a10666ceaf457549d9f6e43f701
SHA256

3c96db743305f78f439fd04e9dd0b32a6c03da2a4d9b5c17af5c8a50aadc8605
SHA512

6710de796eede2d023c2631b0de2561b72177258ad29bd95d07bda203c5be8b7a4b11e5baf1c9c18446e785c5c1ccd4a59ca6d0bea87ad3f0c6ccea92f1f57f3
SSDEEP

6144:3ul5r7dHJMUnwG8v8HdW1e0fRx2iG0HPHkiaCpgDAREQ1pjeBX0GQndtUbUGIb0s:3u/pJMUnehfcspgsfpjeBXrGd2bvR6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4a04062d3202302660f9a2cb0404cb1e_JaffaCakes118

Files

4a04062d3202302660f9a2cb0404cb1e_JaffaCakes118
.dll regsvr32 windows:6 windows x86 arch:x86

48403afc817852f257ff58422709c9d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

sti.pdb

Imports

msvcrt

_CIsqrt
_ftol2_sse
_CIpow
floor
_CIsin
_CIcos
strstr
??_U@YAPAXI@Z
_vsnprintf
_splitpath_s
_vscwprintf
__CxxFrameHandler3
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
_amsg_exit
_initterm
free
malloc
_XcptFilter
??_V@YAXPAX@Z
memcpy
_vsnwprintf
??2@YAPAXI@Z
memset
??3@YAXPAX@Z

api-ms-win-core-localregistry-l1-1-0

RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegEnumValueA
RegQueryValueExA
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegDeleteValueW
RegSetValueExW

kernel32

CreateFileW
GetTempFileNameW
GetTempPathW
LocalAlloc
LocalFree
SetEvent
WaitForSingleObject
GetModuleHandleW
FreeLibraryAndExitThread
CreateThread
CreateEventW
InterlockedExchange
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetFileType
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CloseHandle
DeleteFileW
GetCurrentProcess
IsWow64Process
LoadLibraryW
GetProcAddress
GetLastError
FreeLibrary
DisableThreadLibraryCalls
InitializeCriticalSectionAndSpinCount
GetCommandLineA
DeleteCriticalSection
DeactivateActCtx
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
lstrlenW
HeapFree
GetProcessHeap
HeapAlloc
SetCommMask
EscapeCommFunction
PurgeComm
ClearCommError
ReadFile
ExpandEnvironmentStringsW
SetLastError
GetExitCodeThread
MultiByteToWideChar
CompareStringW
lstrcmpiW
WideCharToMultiByte
lstrlenA
WriteFile
RaiseException
MulDiv
CreateProcessW
GetExitCodeProcess
FormatMessageA
lstrcmpA
GetModuleFileNameA
GetModuleHandleA
ReleaseMutex
CreateMutexW
CreateDirectoryW
LoadLibraryA
GetSystemDirectoryA
TerminateProcess
CreateActCtxW
ReleaseActCtx
ActivateActCtx
GetModuleFileNameW
GetLocalTime

user32

LoadCursorW
PostQuitMessage
DestroyWindow
PostThreadMessageW
LoadStringW
SetDlgItemTextW
SetWindowLongW
RemovePropW
SetPropW
GetPropW
DialogBoxParamW
IsWindow
CharNextA
CharUpperA
ReleaseDC
GetDC
SendMessageW
GetDlgItem
EndDialog
SendDlgItemMessageW
SetWindowTextW
CharUpperBuffW
SetForegroundWindow
MessageBoxW
EnableWindow
DestroyIcon
GetSystemMetrics
LoadIconW
SetWindowPos
GetMonitorInfoW
MonitorFromRect
GetWindowRect
GetDesktopWindow
GetWindowLongW
DispatchMessageW
MsgWaitForMultipleObjects
CreateDialogParamW
PeekMessageW
ShowWindow
GetMessageW
IsDialogMessageW
TranslateMessage
SetCursor

rpcrt4

NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrOleAllocate
NdrOleFree
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
NdrAsyncClientCall
NdrClientCall2
RpcBindingFree
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcAsyncInitializeHandle
RpcAsyncCancelCall
RpcAsyncGetCallStatus
RpcAsyncCompleteCall

gdi32

GetDeviceCaps
DeleteObject
GetObjectW
GetStockObject
CreateFontIndirectW

Exports

Exports

??0BUFFER@@QAE@I@Z
??0BUFFER_CHAIN@@QAE@XZ
??0BUFFER_CHAIN_ITEM@@QAE@I@Z
??1BUFFER@@QAE@XZ
??1BUFFER_CHAIN@@QAE@XZ
??1BUFFER_CHAIN_ITEM@@QAE@XZ
??_FBUFFER@@QAEXXZ
??_FBUFFER_CHAIN_ITEM@@QAEXXZ
?QueryPtr@BUFFER@@QBEPAXXZ
?QuerySize@BUFFER@@QBEIXZ
?QueryUsed@BUFFER_CHAIN_ITEM@@QBEKXZ
?SetUsed@BUFFER_CHAIN_ITEM@@QAEXK@Z
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
MigrateRegisteredSTIAppsForWIAEvents
SelectDeviceDialog2
StiCreateInstance
StiCreateInstanceW

Sections

.text
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 1024B - Virtual size: 821B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

48403afc817852f257ff58422709c9d1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-localregistry-l1-1-0

kernel32

user32

rpcrt4

gdi32

Exports

Exports

Sections

.text Size: 152KB - Virtual size: 151KB

.orpc Size: 1024B - Virtual size: 821B

.data Size: 175KB - Virtual size: 175KB

.rsrc Size: 30KB - Virtual size: 29KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 152KB - Virtual size: 151KB

.orpc
Size: 1024B - Virtual size: 821B

.data
Size: 175KB - Virtual size: 175KB

.rsrc
Size: 30KB - Virtual size: 29KB

.reloc
Size: 7KB - Virtual size: 7KB