5b2b01da65bd21c063b01f490fc4725b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5b2b01da65bd21c063b01f490fc4725b_JaffaCakes118
Size

184KB
MD5

5b2b01da65bd21c063b01f490fc4725b
SHA1

499fd5e40ce35c3cba6c683879924e31b3d42cc0
SHA256

a618a5e3d3e858f0759599720d53050d88e7e4751f6f0103d1f18af45085d0a8
SHA512

9c9e2c72739e1bb48fcd49aec841e40ad56e3ef3cc83c11409964d4e841b737077d2cd5cf9f92c00e630e8c677e9015db2a090765f3cd7449c9d3971b1c3c89d
SSDEEP

3072:mTMFb7yhlERGEKPk4UX6ZfSIn3f8Cq+QVL8mCHEnOmRdaxy+0sZ5Yd9lDINg2ei:mTI3yHyGLsx6ZnPYXV4knvax+rdrSre

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b2b01da65bd21c063b01f490fc4725b_JaffaCakes118

Files

5b2b01da65bd21c063b01f490fc4725b_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

6cb410c7c8084a6a4561e89486a4bc3c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mapi32

ord140
ord75
ord23
ord11
ord21

wsock32

send
WSACleanup
socket
gethostbyname
htons
closesocket
recv
WSAStartup
WSAGetLastError
connect

wininet

InternetSetStatusCallback
HttpOpenRequestA
HttpSendRequestExA
HttpEndRequestA
HttpQueryInfoA
InternetOpenA
InternetCloseHandle
InternetConnectA

kernel32

SetFilePointer
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
lstrlenA
MultiByteToWideChar
WideCharToMultiByte
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
GetCurrentProcess
FlushInstructionCache
lstrcpynA
FindResourceA
LoadResource
FreeLibrary
lstrlenW
InterlockedIncrement
InterlockedDecrement
GetLastError
IsDBCSLeadByte
lstrcmpiA
GetLocaleInfoW
LoadLibraryExA
GetModuleHandleA
InitializeCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
lstrcatA
lstrcpyA
RaiseException
GetModuleFileNameA
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
QueueUserAPC
CloseHandle
DuplicateHandle
GetCurrentThread
Sleep
LoadLibraryA
GetProcAddress
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
WriteFile
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetOEMCP
UnhandledExceptionFilter
SetStdHandle
FlushFileBuffers
VirtualQuery
GetSystemInfo
VirtualAlloc
ExitThread
VirtualProtect
LocalFree
SizeofResource
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
HeapSize
TerminateProcess
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
GetCPInfo
LCMapStringW
LCMapStringA
RtlUnwind
ExitProcess
GetCommandLineA
CreateThread
ResumeThread
HeapReAlloc

user32

SetWindowLongA
GetWindowLongA
CreateWindowExA
DestroyWindow
UnregisterClassA
PostMessageA
CallWindowProcA
CharNextA
wsprintfA
RegisterClassExA
LoadCursorA
GetClassInfoExA
DefWindowProcA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegCloseKey
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegEnumKeyExA

ole32

CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc

oleaut32

SysFreeString
SysAllocString
VariantChangeType
VariantCopy
SysStringByteLen
SysAllocStringByteLen
LoadTypeLi
LoadRegTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
VariantClear
VariantInit
SysStringLen

shlwapi

PathFindExtensionA

urlmon

CoInternetParseUrl

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 120KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6cb410c7c8084a6a4561e89486a4bc3c

Headers

File Characteristics

Imports

mapi32

wsock32

wininet

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

urlmon

Exports

Exports

Sections

.text Size: 120KB - Virtual size: 117KB

.rdata Size: 32KB - Virtual size: 28KB

.data Size: 8KB - Virtual size: 11KB

.rsrc Size: 8KB - Virtual size: 4KB

.reloc Size: 12KB - Virtual size: 10KB

.text
Size: 120KB - Virtual size: 117KB

.rdata
Size: 32KB - Virtual size: 28KB

.data
Size: 8KB - Virtual size: 11KB

.rsrc
Size: 8KB - Virtual size: 4KB

.reloc
Size: 12KB - Virtual size: 10KB