5d23dc28fed0bbcc0820b196123a15a7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5d23dc28fed0bbcc0820b196123a15a7_JaffaCakes118
Size

280KB
MD5

5d23dc28fed0bbcc0820b196123a15a7
SHA1

0130c553a644b30478ffe7da323bb64f2ce65c84
SHA256

2981809c4f636c9b9688843d4022c794071f4af5fb61d1e2af4038ad281204e8
SHA512

cc3d1ac7eb096eacea8448983a55bd1f2805a682cb59494220ba8980fb9dccd12a5e1ae85cf1d13d9f6c939c532030d92f8498114e8af3809e2d840df009cd48
SSDEEP

6144:puzCGWpx2inm4XZ0Q1VseCW06jPYB7ltxQMe5KNQ9SyEf9u2xBnvU:Qzejnm4JN15jPYBvm5JEfQ2c

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d23dc28fed0bbcc0820b196123a15a7_JaffaCakes118

Files

5d23dc28fed0bbcc0820b196123a15a7_JaffaCakes118
.dll windows:4 windows x86 arch:x86

0e81965b5fda7989a8de39e0ef51cdc3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateRemoteThread
WaitForSingleObject
Module32First
GetVersion
GetStdHandle
LocalAlloc
FreeConsole
OutputDebugStringA
WriteProcessMemory
MultiByteToWideChar
SetLastError
GetCurrentThreadId
FileTimeToLocalFileTime
GetWindowsDirectoryA
GetSystemDefaultLangID
GetSystemInfo
GetCurrentProcess
VirtualAllocEx
lstrcmpiA
ReadProcessMemory
GetEnvironmentVariableW
VirtualQueryEx
GlobalReAlloc
GlobalSize
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CreateDirectoryA
RemoveDirectoryA
MoveFileA
WideCharToMultiByte
GetExitCodeThread
GetLocalTime
SystemTimeToFileTime
GetFileAttributesA
SetFileAttributesA
SetConsoleTextAttribute
GlobalAlloc
CopyFileA
DeleteFileA
FindClose
FindFirstFileA
FileTimeToSystemTime
FindNextFileA
CreateFileMappingA
MapViewOfFile
GetFileSize
UnmapViewOfFile
CreateFileA
FormatMessageA
GetProcessHeap
HeapAlloc
HeapFree
GetVersionExA
GetProcAddress
FreeLibrary
GetComputerNameA
LoadLibraryA
WinExec
GetTickCount
GetStartupInfoA
GetSystemDirectoryA
SetCurrentDirectoryA
GetCurrentDirectoryA
WriteFile
ReadFile
Sleep
GetLastError
ExitThread
CreateThread
TerminateThread
WaitForMultipleObjects
TerminateProcess
CreatePipe
Module32Next
OpenProcess
GlobalUnlock
GlobalFree
GlobalLock
GlobalMemoryStatus
GetModuleFileNameA
GetCurrentProcessId
GetDriveTypeA
GetModuleHandleA
GetLogicalDrives
Process32First
GetDiskFreeSpaceA
CreateToolhelp32Snapshot
SetFileTime
Process32Next
MoveFileExA
GetVolumeInformationA
CreateProcessA
GetStringTypeW
LCMapStringA
GetStringTypeA
IsBadReadPtr
HeapDestroy
GetEnvironmentVariableA
ExitProcess
GetCommandLineA
GetSystemTime
CloseHandle
GetTimeZoneInformation
InterlockedIncrement
InterlockedDecrement
RtlUnwind
LocalFree
LCMapStringW
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
DeleteCriticalSection
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
FlushFileBuffers
SetUnhandledExceptionFilter
SetHandleCount
GetFileType
GetCPInfo
GetACP
GetOEMCP
SetEnvironmentVariableA
HeapSize
SetFilePointer
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetExitCodeProcess
SetStdHandle
RaiseException
IsBadCodePtr
SetEndOfFile
CompareStringA
CompareStringW

user32

GetDesktopWindow
ClipCursor
GetClipCursor
MessageBoxA
RedrawWindow
SetWindowTextA
DrawTextA
GetCursorPos
OpenClipboard
EnableWindow
IsClipboardFormatAvailable
SetClipboardData
GetAsyncKeyState
GetKeyState
GetWindowTextA
GetWindowTextLengthA
GetForegroundWindow
EmptyClipboard
CloseClipboard
GetClipboardData
GetSystemMetrics
SendMessageA
PostThreadMessageA
CloseDesktop
ExitWindowsEx
DestroyIcon
CloseWindowStation
SystemParametersInfoA
PostMessageA
SetThreadDesktop
OpenDesktopA
SetProcessWindowStation
OpenWindowStationA
GetThreadDesktop
GetProcessWindowStation
GetUserObjectInformationA
OpenInputDesktop
ReleaseDC
GetDC
keybd_event
mouse_event
GetMessageA

gdi32

CreateDIBSection
CreateCompatibleDC
CreateFontIndirectA
SelectObject
BitBlt
CreateCompatibleBitmap
GetStockObject
SelectPalette
GetObjectA
GetDIBits
DeleteObject
RealizePalette
GetDeviceCaps
SetTextColor
CreateDCA
DeleteDC
SetBkMode

advapi32

RegOpenKeyExA
AdjustTokenPrivileges
SetServiceStatus
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegEnumValueA
RegEnumKeyExA
RegQueryValueExA
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
CloseEventLog
ClearEventLogA
OpenEventLogA
CreateServiceA
StartServiceA
CloseServiceHandle
OpenServiceA
OpenSCManagerA
ControlService
QueryServiceStatus
ChangeServiceConfigA
QueryServiceConfigA
RegisterServiceCtrlHandlerA
RegCreateKeyA
GetUserNameA
DeleteService
EnumServicesStatusExA
QueryServiceConfig2A
QueryServiceStatusEx
RegQueryInfoKeyA
RegOpenKeyA
RegEnumKeyA

shell32

SHGetFileInfoA
ShellExecuteA

ole32

CoTaskMemFree
CoInitialize
CoInitializeEx
CoCreateInstance
CoUninitialize

oleaut32

SysFreeString
VariantClear

iphlpapi

GetAdaptersInfo
SetTcpEntry
GetTcpTable

psapi

GetModuleFileNameExA
EnumProcessModules

ws2_32

inet_addr
htonl
bind
listen
accept
__WSAFDIsSet
htons
setsockopt
WSAStartup
socket
WSAGetLastError
ntohs
connect
select
WSACleanup
gethostbyname
inet_ntoa
recv
send
closesocket

winmm

waveInStart
waveInReset
waveInOpen
waveInClose
waveInUnprepareHeader
waveInAddBuffer
waveOutGetNumDevs
midiOutGetNumDevs
waveOutGetDevCapsA
midiOutGetDevCapsA
PlaySoundA
mciSendStringA
waveInPrepareHeader

wininet

InternetReadFile
HttpQueryInfoA
InternetOpenA
InternetOpenUrlA
InternetCloseHandle

netapi32

NetApiBufferFree
NetUserDel
NetUserAdd
NetUserEnum

avicap32

capGetDriverDescriptionA

msvfw32

ICOpen
ICSendMessage
ICClose
ICImageCompress
ICCompress

Exports

Exports

AddUser
DelUser
GetSysInfo
GetUser
InstallPE
InstallRT
InstallSA
InstallSB
InstallServiceA
InstallServiceB
MyConfigService
MyDeleteService
MyInstallService
MyListService
MyStartService
MyStopService
MyViewService
PEmain
PSLIST
ServiceMain
UninstallPE
UninstallRT
UninstallSA
UninstallSB
UninstallServiceA
UninstallServiceB
clonemain
nt2Kfindpass
win2003findpass

Sections

.text
Size: 180KB - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 547KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0e81965b5fda7989a8de39e0ef51cdc3

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

iphlpapi

psapi

ws2_32

winmm

wininet

netapi32

avicap32

msvfw32

Exports

Exports

Sections

.text Size: 180KB - Virtual size: 177KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 64KB - Virtual size: 547KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 180KB - Virtual size: 177KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 64KB - Virtual size: 547KB

.reloc
Size: 16KB - Virtual size: 15KB