4b136db6cbe7cf8f3f046ed8a71dea55_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

4b136db6cbe7cf8f3f046ed8a71dea55_JaffaCakes118
Size

843KB
MD5

4b136db6cbe7cf8f3f046ed8a71dea55
SHA1

b7489a92ceefddfbc7f79a9c6345989e4a481877
SHA256

748f51c10cfa4ca818b1528dce17e6bb4f866a9bfd498af72fa68ed9f28be554
SHA512

9472e3534f61322ea24592d43d5c242284903f380141d7320439f5879ca5fe6f45243d505cd5dc74a07dc03fb1495f31ab1f73be35c9f6755e77e99b5ddca4ad
SSDEEP

12288:+ahjP5R/1Pw+p83iHDqQyykPfZhpHUmBvj0KML8tf8j:+aLRNPPp83ijGLddU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
4b136db6cbe7cf8f3f046ed8a71dea55_JaffaCakes118

Files

4b136db6cbe7cf8f3f046ed8a71dea55_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

592b0e006affbba3b1ffa247bc066768

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW

comctl32

CreatePropertySheetPageW
DestroyPropertySheetPage

gdi32

GetStockObject
DeleteDC
ChoosePixelFormat
SetPixelFormat
CreateDCA
ExtEscape

kernel32

InterlockedDecrement
GetCommandLineA
RtlUnwind
GetLocaleInfoA
GetConsoleOutputCP
SetHandleCount
LCMapStringW
GetEnvironmentStringsW
SetLastError
FreeLibrary
GetProcAddress
GetCurrentThreadId
TlsSetValue
GetModuleHandleW
LCMapStringA
VirtualProtect
LeaveCriticalSection
GetFileType
GetConsoleCP
DeleteCriticalSection
RaiseException
GetStdHandle
GetModuleHandleA
FlushFileBuffers
GetCurrentDirectoryA
SetCurrentDirectoryA
TlsFree
GetEnvironmentStrings
GetLastError
GetStringTypeA
SetStdHandle
VirtualFree
GetStartupInfoA
LoadLibraryA
FreeEnvironmentStringsA
GetStringTypeW
HeapSize
CloseHandle
VirtualAlloc
GetVersionExA
UnhandledExceptionFilter
HeapReAlloc
WideCharToMultiByte
MultiByteToWideChar
FreeEnvironmentStringsW
CreateEventA
OpenEventA
Sleep
GetOEMCP
TlsAlloc
InitializeCriticalSection
HeapCreate
WriteFile
SetFilePointer
EnterCriticalSection
LocalFree
HeapDestroy
GetTickCount
TerminateProcess
GetProcessHeap
GetConsoleMode
TlsGetValue
QueryPerformanceCounter
ExitProcess
IsValidCodePage
IsDebuggerPresent
HeapFree
InterlockedIncrement
GetCPInfo
GetModuleFileNameA
HeapAlloc
CreateFileA
GetACP
LocalAlloc
GetCurrentProcessId
lstrlenW
WriteConsoleA
SetUnhandledExceptionFilter
WriteConsoleW
GetCurrentProcess

msvcrt

_wtol
free
_amsg_exit
malloc
_XcptFilter
_initterm
memset

opengl32

wglGetProcAddress
glDrawBuffer
glTexCoord2f
glGetTexImage
glGetString
wglDeleteContext
wglMakeCurrent
glTexImage2D
glMatrixMode
glViewport
glBegin
glBindTexture
glOrtho
glVertex2f
glGenTextures
glEnable
glTexParameteri
glGetError
glLoadIdentity
glEnd
wglCreateContext
glDeleteTextures

setupapi

SetupDiSetDeviceRegistryPropertyW
SetupFindFirstLineW
SetupCloseInfFile
SetupDiSetDeviceInstallParamsW
SetupDiGetDriverInfoDetailW
SetupDiOpenDevRegKey
SetupDiCallClassInstaller
SetupDiGetClassInstallParamsW
SetupDiSetClassInstallParamsW
SetupGetIntField
SetupDiGetSelectedDriverW
SetupOpenInfFileW
SetupDiGetActualSectionToInstallW
SetupDiGetDeviceInstallParamsW
SetupGetMultiSzFieldW
SetupDiGetDeviceRegistryPropertyW

user32

EnumDisplayDevicesA
MessageBoxW
MessageBoxA
TranslateMessage
ReleaseDC
ShowWindow
PostMessageW
EnableWindow
SendDlgItemMessageW
SendMessageW
MsgWaitForMultipleObjectsEx
PostQuitMessage
RegisterClassExA
UnregisterClassA
DefWindowProcA
GetDC
LoadIconA
EnumDisplaySettingsExA
GetWindowLongW
DispatchMessageA
LoadStringW
SetWindowLongW
SetDlgItemTextW
CreateWindowExA
GetFocus
GetParent
LoadCursorA
EndDialog

Exports

Exports

Haughtiness
Nutmegged
Pseudoheroic
DllRegisterServer
Psychomorphic
Outsearch
Boxwallah
Syphilopsychosis
Flightiness
Unconscient
Creditability
Atelocephalous
Carbinyl
Exocardiac
Tyro
Chamaeleontidae
Prefamiliar
Alepot
Veratrinize
Taylorize
Hypernutrition
Pneumonocarcinoma
Nectareal
Plutarchical
Feebleness
Favorer
Unboasting
Dichromatism
Anophelinae
Perplexable
Eruptiveness
Bibiri
Berberian
Nibsome
Evadne
Jansenism
Imagines
Fibrocellular
Nonportability
Rerow
Rageless
Toskish
Pinpillow
Noncommercial
Betitle
Toadflax
Dartlike
Completer
DllUnregisterServer
Monosymmetry
Nauseatingly
Kinesthesia
Diplococcic
Younger
Achetidae
Jawless
Dentalium
Dilatometric
Theriotrophical
Viceregal
Hynde
Kingcup
Placentigerous
Dermomuscular
Subsurety
Miserableness
Ephydriad
Thunor
Imitativeness
Terma
Unclassical
Unaudienced

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 279KB - Virtual size: 295KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 519KB - Virtual size: 518KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

592b0e006affbba3b1ffa247bc066768

Headers

File Characteristics

Imports

advapi32

comctl32

gdi32

kernel32

msvcrt

opengl32

setupapi

user32

Exports

Exports

Sections

.text Size: 35KB - Virtual size: 34KB

.rdata Size: 279KB - Virtual size: 295KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 519KB - Virtual size: 518KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 35KB - Virtual size: 34KB

.rdata
Size: 279KB - Virtual size: 295KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 519KB - Virtual size: 518KB

.reloc
Size: 3KB - Virtual size: 3KB